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Abstract 

Network coding is studied when an adversary controls a subset of nodes in the network of hmited 
quantity but unknown location. This problem is shown to be more difficult than when the adversary 
controls a given number of edges in the network, in that linear codes are insufficient. To solve the node 
problem, the class of Polytope Codes is introduced. Polytope Codes are constant composition codes 
operating over bounded polytopes in integer vector fields. The polytope structure creates additional 
complexity, but it induces properties on marginal distributions of code vectors so that validities of 
codewords can be checked by internal nodes of the network. It is shown that Polytope Codes achieve 
a cut-set bound for a class of planar networks. It is also shown that this cut-set bound is not always 
tight, and a tighter bound is given for an example network. 

I. Introduction 

Network coding allows routers in a network to execute possibly complex codes in addition 
to routing; it has been shown that allowing them to do so can increase communication rate 
[[ll. However, taking advantage of this coding at internal nodes means that the sources and 
destinations must rely on other nodes — nodes they may not have complete control over — to 
reliably perform certain functions. If these internal nodes do not behave correctly, or, worse, 
maliciously attempt to subvert the goals of the users — constituting a so-called Byzantine attack 
[HI, [El — standard network coding techniques fail. 
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Suppose an omniscient adversary controls an unknown portion of the network, and may 
arbitrarily corrupt the transmissions on certain communication links. We wish to determine how 
the size of the adversarial part of the network influences reliable communication rates. If the 
adversary may control any z unit-capacity edges in the network, then it has been shown that, for 
the multicast problem (one source and many destinations), the capacity reduces by 2z compared 
to the non-Byzantine problem JH, Q. To achieve this rate, only linear network coding is needed. 
Furthermore, if there is just one source and one destination, coding is needed only at the source 
node; internal nodes need only do routing. 

The above model assumes that any set of z edges may be adversarial, which may not accurately 
reflect all types of attacks. This model is accurate if the attacker is able to cut transmission lines 
and change messages that are sent along them. However, if instead the attacker is able to seize 
a router in a network, it will control the values on all links connected to that router. Depending 
on which router is attack, the number of the links controlled by the adversary may vary. In an 
effort to more accurately model this situation, in this paper we assume that the adversary may 
control any set of s nodes. 

Defeating node-based attacks is fundamentally different from defeating edge-based attacks. 
First, the edge problem does not immediately solve the node problem. Consider, for example, 
the Cockroach network, shown in Fig. [TJ Suppose we wish to handle any single adversarial node 
in the network (i.e. s = 1). One simple approach would be to apply to edge result from H, [HI: 
no node controls more than two unit-capacity edges, so we can defeat the node-based attack by 
using a code that can handle an attack on any two edges. However, note that the achievable rate 
for this network without an adversary is 4, so subtracting twice the number of bad edges leaves 
us with an achievable rate of 0. As we will show, the actual capacity of the Cockroach network 
with one traitor node is 2. In effect, relaxing the node attack problem to the edge attack problem 
is too pessimistic, and we can do better if we treat the node problem differently. 

Node-based attacks and edge-based attacks differ in an even more fundamental way. When 
the adversary may sieze control of any set of z unit-capacity edges, it is clear that it should 
always take over edges on the minimum cut of the network. However, if the adversary may sieze 
any s nodes, it is not so obvious: it may face a choice between a node directly on the min-cut, 
but with few output edges, and a node away from the min-cut, but with many output edges. For 
example, in the Cockroach network, node 4 has only one output edge, but it is on the min-cut 



Fig. 1. The Cockroach Network. All edges have capacity 1. The capacity is 2, but no linear code can achieve a rate higher 
than 4/3. A proof of the linear capacity is given in Appendix |B] A capacity-achieving linear code supplemented by nonlinear 
comparisons is given in Sec. [V] and a capacity-achieving Polytope Code is given in Sec. IVIII 

(which is between nodes S, 1, 2, 3, 4, 5 and D); node 1 has two output edges, so apparently more 
power, but it is one step removed from the min-cut, and therefore its power may be diminished. 
This uncertainty about where a network is most vulnerable seems to make the problem hard. 
Indeed, we find that many standard network coding techniques fail to achieve capacity, so we 
resort to nonlinear codes, and in particular Polytope Codes, to be described. 

A. Related Work 

Byzantine attacks on network coding were first studied in (6], which looked at detecting 
adversaries in a random linear coding environment. The z unit-capacity edge adversary problem 
was solved in flU, [|5l. Li Q, the same problem is studied, providing distributed and low 
complexity coding algorithms to achieve the same asymptotically optimal rates. In addition, 
[|71 looks at two adversary models slightly different from the omniscient one considered in [4], 
[[51 and in this paper. They show that higher rates can be achieved under these alternate models. 
In [El, a more general view of the adversary problem is given, whereby the network itself is 
abstracted into an arbitrary linear transformation. 

Network coding under Byzantine attacks that are more general than the simple edge-based 
model was first studied in [|9l, a conference version of this work, and [[TOl. The latter looked at the 
problem of edge-based attacks when the edges may have unequal capacities. This problem was 
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found to have similar complications to the node-based problem. In particular, both [|9l and [[TOl 
found that linear coding is suboptimal, and that simple nonlinear operations used to augment 
a linear code can improve throughput. Indeed, [fTOll used a network almost identical to what 
we call the Cockroach network to demonstrate that nonlinear operations are necessary for the 
unequal edge problem. We show in Sec. |X]that the unequal-capacity edge problem is subsumed 
by the node problem. 

These works seek to correct for the adversarial errors at the destination. An alternative strategy 
known as the watchdog, studied for wireless network coding in fTTIl, is for nodes to police 
downstream nodes by overhearing their messages to detect modifications. In ^2^, a similar 
approach is taken, and they found that nonlinear operations similar to ours can be helpful, in 
which comparisons are made to detect errors. 

B. Main Results 

Many achievability results in network coding have been proved using linear codes over a finite 
field. In this paper we demonstrate that linear codes are insufficient for this problem. Moreover, 
we develop a class of codes called Polytope Codes, originally introduced in under the less 
descriptive term "bounded-linear codes". Polytope codes are used to prove that a cut-set bound, 
stated and proved in Sec. UlIl is tight for a certain class of networks. Polytope Codes differ from 
linear codes in three ways: 

1) Comparisons: A significant tool we use to defeat the adversary is that internal nodes in the 
network perform comparisons: they check whether their received data could have occurred 
if all nodes had been honest. If not, then there must be an upstream traitor that altered one of 
the received values, in which case this traitor can be localized. The result of the comparison, 
a bit signifying whether or not it succeeded, can be transmitted downstream through the 
network. The destination receives these comparison bits and uses them to determine who 
may be the traitors, and how to decode. These comparison operations are nonlinear, and, as 
we will demonstrate in Sec. |Vl incorporating them into a standard finite-field linear code 
can increase achieved rate. However, even standard linear codes supplemented by these 
nonlinear comparison operations appears to be insufficient to achieve capacity in general. 
Polytope Codes also incorporate comparisons, but of a more sophisticated variety. 
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2) Constant Composition Codebooks: Unlike usual linear network codes, Polytope Codes are 
essentially constant composition codes. In particular, each Polytope Code is governed by a 
joint probability distribution on a set of random variables, one for each edge in the network. 
The codebook is composed of the set of all sequences with joint type exactly equal to 
this distribution. The advantage of this method of code construction is that an internal 
node knows exactly what joint type to expect of its received sequences, because it knows 
the original distribution. In a Polytope Code, comparisons performed inside the network 
consist of checking whether the observed joint type matches the expected distribution. If 
it does not, then the adversary must have influenced one of the received sequences, so it 
can be localized. 

3) Distributions over Poly topes: The final difference between linear codes and Polytope 
Codes — and the one for which the latter are named — comes from the nature of the proba- 
bility distributions that, as described above, form the basis of the code. They are uniform 
distributions over the set of integer lattice points on polytopes in real vector fields. This 
choice for distribution provides two useful properties. First, the entropy vector for these 
distributions can be easily calculated merely from properties of the linear space in which 
the polytope sits. For this reason, they share characteristics with finite-field linear codes. In 
fact, a linear code can almost always be converted into a Polytope Code achieving the same 
rate. (There would be no reason to do this in practice, since Polytope Codes require much 
longer blocklengths.) The second useful property has to do with how the comparisons inside 
the network are used. These distributions are such that if enough comparisons succeed, the 
adversary is forced to act as an honest node and transmit correct information. We consider 
this to be the fundamental property of Polytope Codes. It will be elaborated in examples in 
Sec. |VI]and Sec. IVIIl and then stated in its most general form as Theorem |3] in Sec. IVIIII 

We state in Sec. |W] our result that the cut-set bound can be achieved using Polytope Codes 
for a class of planar networks. Planarity requires that the graph can be embedded in a plane such 
that intersections between edges occur only at nodes. This ensures that enough opportunities for 
comparisons are available, allowing the code to more well defeat the adversary. The theorem is 
proved in Sec. HXl but first we develop the theory of Polytope Codes through several examples 
in Sec. IVl - IVIII In addition, we show in Sec. |X] that the cut-set bound is not always tight, by 



6 



giving an example with a tighter bound. We conclude in Section |Xll 

II. Problem Formulation 

Let (y, E) be an directed acyclic graph. We assume all edges are unit-capacity, and there may 
be more than one edge connecting the same pair of nodes. One node in V is denoted S, the 
source, and one is denoted D, the destination. We wish to determine the maximum achievable 
communication rate from S io D when any set of s nodes in V \ {S*, D} are traitors; i.e. they 
are controlled by the adversary. Given a rate R and a block-length n, the message W is chosen 
at random from the set {1, . . . , 2"^}. Each edge e holds a value Xe G {1, . . . , 2"}. 

A code is be made up of three components: 

1) an encoding function at the source, which takes the message as input and produces values 
to place on all output edges, 

2) a coding function at each internal node i G V\{S, D}, which takes the values on all input 
edges to i, and produces values to place on all output edges from i, 

3) and a decoding function at the destination, which takes the values on all input edges and 
produces an estimate W of the message. 

Suppose T (IV \ {S,D} is the set of traitors, with |T| = s. They may subvert the coding 
functions at nodes i G T by placing arbitrary values on all the output edges from these nodes. 
Let Zt be the set of values on these edges. For a particular code, specifying the message W 
as well as Zt determines exactly the values on all edges in the network, in addition to the 
destination's estimate W . We say that a rate R is achievable if there exists a code operating 
at that rate with some block-length n such that for all messages, all sets of traitors T, and all 
values of Zt, W = W. That is, the destination always decodes correctly no matter what the 
adversary does. Let the capacity C be the supremum over all achievable rates. 

III. Cut-Set Upper Bound 

It is shown in flU, BH that, if an adversary controls z unit-capacity edges, the network coding 
capacity reduces by 2z. This is a special case of a more general principle: an adversary-controlled 
part of the network does twice as much damage in rate as it would if that part of the network 
were merely removed. This doubling effect is for the same reason that, in a classical error 
correction code, the Hamming distance between codewords must be at least twice the number 
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of errors to be corrected; this is the Singleton bound |fT3l . We now give a cut-set upper bound 
for node-based adversaries in network coding that makes this explicit. 

A cut in a network is a subset of nodes A C V containing the source but not the destination. 
The cut-set upper bound on network coding without adversaries is the sum of the capacities of all 
forward-facing edges; that is, edges (i, j) with i E A and j ^ A. All backward edges are ignored. 
In the adversarial problem, backward edges are more of a concern. This is because the bound 
relies on messages that are sent along edges not controlled by the adversary being unaffected by 
those that are, which is not guaranteed in the presence of a backwards edge. We give an example 
of this in Appendix El To avoid the complication, we state here a simplified cut-set bound that 
applies only to cuts without backward edges. This bound will be enough to find the capacity 
of the class of planar networks to be specified in Sec. |IVl but for the general problem it can 
be tightened. We state and prove a tighter version of the cut-set bound in Appendix |Al Unlike 
the problem without adversaries, we see that there is no canonical notion of a cut-set bound. 
Some even more elaborate bounds are found in ifTOll . lfT4l . These papers study the unequal-edge 
problm, but the bounds can be readily applied to the node problem. 

It was originally conjectured in fTOl that even the best cut-set bound is not tight in general. 
In Sec. |Xl we demonstrate that there can be an active upper bound on capacity fundamentally 
unlike a cut-set bound. The example used to demonstrate this, though it is a node adversary 
problem, can be easily modified to confirm the conjecture stated in ifTOll . 

Theorem 1: Consider a cut A C V with S E A and D ^ A and with no backward edges; 
that is, there is no edge (i, j) E E with i ^ A and j E A. If there are s traitor nodes, then for 
any set f/ C V \ {S, D} with \U\ = 2s, the following upper bound holds on the capacity of the 
network: 

C<\{ii,j)EE:iEA\U,j^A}\. (1) 

Proof: Divide U into two sets Ti and T2 with |Ti| = IT2I = s. Let Ei and E2 be the sets of 
edges out of nodes in Ti and T2 respectively that cross the cut; that is, edges (z,j) with i E A 
and j ^ A. Let E be the set of all edges crossing the cut not out of nodes in Ti or T2. Observe 
that the upper bound in ([T]) is precisely the total capacity for all edges in E. Note also that, 
since there are no backwards edges for the cut A, the values on edges in E are not influenced 
by the values on edges in Ei or E2. This setup is diagrammed in Fig. |2l 
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Fig. 2. Diagram of the proof of Tfieorem[T] Tlie values on tlie links crossing the cut are such that it is impossible to determine 
whether Ti or T2 is the true set of traitors, and which of wi or W2 is the true message. 

Suppose © does not hold. Therefore there exists a code with block-length n achieving a rate 
R higher than the right hand side of For any set of edges F C E, for this code, we can 
define a function 

Xp : 2"^ ^ JJ 2" (2) 

eeF 

such that for a message w, assuming all nodes act honestly, the values on edges in F is given by 
Xp{w). Since R is greater than the total capacity for all edges in E, there exists two messages 
wi and W2 such that X^(wi) = Xe{w2). 

We demonstrate that it is possible for the adversary to confuse the message wi with W2. 
Suppose wi were the true message, and the traitors are Ti. The traitors replace the values sent 
along edges in Ei with Xei{w2). If there are edges out of nodes in Ti that are not in Ei — i.e. 
they do not cross the cut — the traitors do not alter the values on these edges. Thus, the values 
sent along edges in E are given by Xp{wi). Now suppose W2 were the true message, and the 
traitors are T2. They replace the messages going along edges in E2 with Xe2{wi), again leaving 
all other edges alone. Note that in both these cases, the values on Ei are Xs^(w2), the values 
on E2 are XE2iwi), and the values on E are X^(wi). This comprises all edges crossing the cut, 
so the destination receives the same values under each case; therefore it cannot distinguish wi 
from W2. ■ 

We illustrate the use of Theorem [T] on the Cockroach network, as shown in Fig. [H with a 
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single adversary node. To apply the bound, we choose a cut A and a set U with \U\ = 2s = 2. 
Take A = {5*, 1, 2, 3, 4, 5}, and U = {1,4}. Four edges cross the cut, but the only ones not 
out of nodes U are {S,D) and {5,D), so we may apply Theorem [T] to give an upper bound on 
capacity of 2. Alternatively, we could take A = {S*, 1,2,3} and U = {1,2}, to give again an 
upper bound of 2. Note that there are 6 edges crossing this second cut, even though the cut-set 
bound is the same. It is not hard to see that 2 is the smallest upper bound given by Theorem [T] 
for the capacity of the Cockroach network. In fact, rate 2 is achievable, as will be shown in 
Sec. |V] using a linear code supplemented by comparison operations, and again in Sec. IVIII using 
a Poly tope Code. 

IV. Capacity of A Class of Planar Networks 
Theorem 2: Let {V^E) be a network with the following properties: 

1) It is planar. 

2) No node other than the source has mare than two unit-capacity output edges. 

3) No node other than the source has more output edges than input edges. 

4) There is at most one traitor (i.e. s = 1). 

The cut-set bound given by Theorem [T] is tight for (V, E). 

Polytope Codes are used to prove achievability for this theorem. The complete proof is given 
in Sec. |IXl but first we develop the theory of Polytope Codes by means of several examples in 
Sec. rVl - IVIII and general properties in Sec. IVIIIi 

Perhaps the most interesting condition in the statement of Theorem [2] is the planarity condition. 
Recall that a graph is said to be embedded in a surface (generally a two dimensional manifold) 
when it is drawn in this surface so that edges intersect only at nodes. A graph is planar if it 
can be embedded in the plane. 

V. A Linear Code with Comparisons for the Cockroach Network 

The Cockroach network satisfies the conditions of Theorem [2l Fig [T] shows a plane embedding 
with both S and D on the exterior, and the second and third conditions are easily seen to be 
satisfied. Therefore, since the smallest cut-set bound given by Theorem [T] for a single traitor 
node is 2, Theorem [2] claims that the capacity of the Cockroach network is 2. In this section, 
we present a capacity-achieving code for the Cockroach network that is composed of a linear 



10 



code over a finite-field supplemented by nonlinear comparisons. This illustrates the usefulness 
of comparisons in defeating Byzantine attacks on network coding. Before doing so, we provide 
an intuitive argument that linear codes are insufficient. A more technical proof that the linear 
capacity is in fact 4/3 is given in Appendix |Bl 

Is it possible to construct a linear code achieving rate 2 for the Cockroach network? We know 
from the Singleton bound-type argument — the argument at the heart of the proof of Theorem [l] — 
that, in order to defeat a single traitor node, if we take out everything controlled by two nodes, 
the destination must be able to decode from whatever remains. Suppose we take out nodes 2 and 
3. These nodes certainly control the values on (5, D) and (3, D), so if we hope to achieve rate 
2, the values on (1, D) and (4, D) must be uncorruptable by nodes 2 and 3. Edge (1, D) is not a 
problem, but consider (4, D). With a linear code, the value on this edge is a linear combination 
of the values on (1,4) and (2, 4). In order to keep the value on (4, D) uncorruptable by node 2, 
the coefficient used to construct the value on (4, from (2,4) must be zero. In other words, 
node 4 must ignore the value on (2,4) when constructing the value it sends on (4, D). If this 
is the case, we lose nothing by removing (2, 4) from the network. However, without this edge, 
we may apply Theorem [H with A = {S, 1, 2, 3} and U = {1, 3} to conclude that the capacity is 
no more than 1. Therefore no linear code can successfully achieve rate 2. 

This argument does not rigorously show that the linear capacity is less than 2, because it 
shows only that a linear code cannot achieve exactly rate 2, but it does not bound the achievable 
rate with a linear code away from 2. However, it is meant to be an intuitive explanation for the 
limitations of linear codes for this problem, as compared with the successful nonlinear codes 
that we will subsequently present. The complete proof that the linear capacity is 4/3 is given in 
Appendix |Bl 

We now introduce a nonlinear code to achieve the capacity of 2. We work in the finite field 
of p elements. Let the message w he a 2A;-length vector split into two A;-length vectors x and y. 
We will use a block length large enough to place one of 2p'' values on each link. In particular, 
this is enough to place on a link some linear combination of x and y, as well as one additional 
bit. For large enough k, this extra bit becomes insignificant, so we still achieve rate 2. 

The scheme is shown in Figure [3l Node 4 receives the vector y from both nodes 1 and 2. It 
forwards one of these copies to D (it does not matter which). In addition, it performs a nonlinear 
comparison between the two received copies of y, resulting in a bit comprised of one of the 
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special symbols = or 7^. If the two received copies of y agree, it sends =, otherwise it sends 
7^. The link (4, D) can accommodate this, since it may have up to 2p'^ messages placed on it. 
Node 5 does the same with its two copies of the vector x + y. 

The destination's decoding strategy depends on the two comparison bits sent from nodes 4 
and 5, as follows: 

• If node 5 sends 7^ but node 4 sends =, then the traitor must be one of nodes 1, 2, or 4. In any 
case, the vector x — y received from node 3 is certainly trustworthy. Moreover, x + y can be 
trusted, because even if node 2 is the traitor, its transmission must have matched whatever 
was sent by node 3; if not, node 5 would have transmitted 7^. Therefore the destination can 
trust both x + y and x — y, from which it can decode the message w = {x, y). 

• If node 5 sends 7^ but node 4 sends =, then we are in the symmetric situation and can 
reliably decode w from x and y. 

• If both nodes 4 and 5 send 7^, then the traitor must be node 2, in which case the destination 
can reliable decode from x and x — y. 

• If both messages are =, then the destination cannot eliminate any node as a possible traitor. 
However, we claim that at most one of x,y, x + y, x — y can have been corrupted by the 
traitor. If node 1 is the traitor, it may choose whatever it wants for x, and the destination 
would never know. However, node 1 cannot impact the value of y without inducing a 7^, 
because its transmission to node 4 is verified against that from node 2. Similarly, node 
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3 controls x — y but not x + y. Nodes 4 and 5 control only y and x + y respectively. 
Node 2 controls nothing, because both y and x + y are checked against other transmissions. 
Therefore, if the destination can find three of x,y,x + y,x — y that all agree on the message 
w, then this message must be the truth because only one of the four could be corrupted, 
and w can be decoded from the other two. Conversely, there must be a group of three of 
x,y,x + y,x + 2y that agree, because at most one has been corrupted. Hence, the destination 
can always decode w. 

Even though our general proof of Theorem [21 uses a Polytope Code, which differs significantly 
from this one, the manner in which the comparisons comes into play is essentially the same. The 
key insight is to consider the code from the perspective of the traitor. Suppose it is node 1, and 
consider the choice of what value for y to send along edge (1,4). If it sends a false value for 
y, then the comparison at node 4 will fail, which will lead the destination to consider the upper 
part of the network suspect, and thereby ignore all values influenced by node 1 . The only other 
choice for node 1 is to cause the comparison at node 4 to succeed; but this requires sending the 
true value of y, which means it has no hope to corrupt the decoding process. This is the general 
principle that makes our codes work: force the to make a choice between acting like an honest 
node, or acting otherwise and thereby giving away its position. 

We make one further note on this code, having to do with why the specific approach used 
here for the Cockroach network fails on the more general problem. Observe that in order to 
make an effective comparison, the values sent along edges (1,4) and (2, 4) needed to be exactly 
the same. If they had been independent vectors, no comparison could be useful. This highly 
constrains the construction of the code, and even though it succeeds for this network, it fails 
for others, such as the Caterpillar network, to be introduced in the next section. The advantage 
of the Polytope Code is that it deconstrains the types of values that must be available in order 
to form a useful comparison; in fact, it becomes possible to have useful comparisons between 
nearly independent variables, which is not possible with a code built on a finite-field. 

VI. An Example Polytope Code: The Caterpillar Network 

The Caterpillar Network is shown in Figure ID We consider a slightly different version of the 
node-based attack on this network: at most one node may be a traitor, but only nodes 1-4. This 
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Fig. 4. The Caterpillar Network. All edges have unit capacity. One node may be a traitor, but only one of the black nodes: 
nodes 1-A. 

network is not in the class defined in the statement of Theorem [21 but we introduce it in order 
to motivate the Poly tope Code. 

Even though this problem differs from the one defined earlier in that not every node in the 
network may be a traitor, it is easy to see that we may still apply the cut-set bound of Theorem [T] 
as long as we take the set t/ to be a subset of the allowable traitors. If we apply Theorem [U 
with A = {S, 1,2,3,4} and U = {1,2}, we find that the capacity of this network is no more 
than 2. As we will show, the capacity is 2. 

Consider what is required to achievae rate 2. Of the four values on the edges (1,5), (2,6), 
(3, 7), and (4, 8), one may be corrupted by the adversary. This means that these four values must 
form a (4, 2) MDS code. That is, given any uncorrupted pair of these four values, it must be 
possible to decode the message exactly. Since each edge has capacity 1, in order to achieve rate 
2, the values on each pair of edges must be independent, or nearly independent. For example, 
we could take the message to be composed of two elements x, y from a finite field, and transmit 
on these four edges x,y, x + y, x — y. However, as we will show, this choice does not succeed. 

Now consider the two edges {9,D) and {10, D). As these are the only edges incident to the 
destination, to achieve rate 2, both must hold values guaranteed to be uncorrupted by the traitor. 
We may assume that nodes 5-8 forward whatever they receive on their incoming edges to all 
their outgoing edges, so node 10 receives all four values sent from nodes 1-4. From these, it 
can decode the entire message, so it is not a problem for it to construct a trustworthy value to 
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send along (10, D). However, node 9 has access to only three of the four values sent from nodes 
1-4, from which it is not clearly possible to construct a trustworthy value. The key problem, 
then, is to design the values on edges (1,5), (2,6), (3,7) to be pairwise independent, but such 
that if one value is corrupted, it is always possible to construct a trustworthy value to transmit 
on (9,-D). This is impossible to do using a finite field code. For example, suppose node 9 is 
given values for x, y,x + y, one of which may be corrupted by the traitor. If the linear constraint 
among these three values does not hold — that is, if the received value for x + y does not match 
the sum of the value for x and the value for y — then any of the three values may be the incorrect 
one. Therefore, from node 9's perspective, any of nodes 1, 2, or 3 could be the traitor. In order 
to produce a trustworthy symbol, it must be able to correctly conclude that one of these three 
nodes is not the traitor. If, for example, it could determine that the traitor was node 1 or node 2 
but not node 3, then the value sent along (3, 7) could be forwarded to (9, D) with a guarantee 
of correctness. A linear code over a finite field does not allow this, but a Polytope Code does. 

A. Coding Strategy 

We now begin to describe a capacity-achieving Polytope Code for the Caterpillar network. We 
do so first by describing how the code is built out of a probability distribution, and the properties 
we need this probability distribution to satisfy. Subsequently, we give an explicit construction 
for a probability distribution derived from a polytope in a real vector field, and show that it has 
the desired properties. 

Let X, Y, Z, W be jointly distributed random variables, each defined over the finite alphabet 
X. Assume all probabilities on these random variables are rational. Let T'^{XY ZW) e X^" 
be the set of joint sequences [x^y^z^w^) with joint type exactly equal to the distribution on 
X, Y, Z, W. For n such that T^{XYZW) is not empty, we know from the theory of types that 



Our coding strategy will be to associate each element of T"'{XYZW) with a distinct message. 
Given the message, we find the associated four sequences x", y", z", w", and transmit them on 
the four edges out of nodes 1,2,3,4 respectively. Doing this requires placing a sequence in X"^ 
on each edge. The rate of this code is 



T'^iXYZW)] > 



1 



2nH{XYZW) 



{n + i)m 



(3) 



log \T''{XYZW)\ H{XYZW) |X| 




Mog(n + l) 
nlog |X| 



(4) 
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Note that for sufficiently large n, we may operate at a rate arbitrarily close to -^^^^l^fp^- 
Therefore, to achieve rate 2, we would like the following property to hold. 
Property 1: ^^^^gJP = 2. 

The adversary may alter the value of one of the sequences sent out of nodes 1-4. By the 
Singleton bound argument, it must be possible to reconstruct the message from any two of these 
four sequences. We therefore need the following property. 

Property 2: Any two of X, Y, Z, W determine the other two. 

For reasons that will become clear, we also need the following property. It is an example of 
the fundamental property of Poly tope Codes. 

Property 3: Any random variables X, Y, Z satisfying the three conditions 

(5) 

{X,Z)r^{X,Z) (6) 

{Y,Z)^{Y,Z) (7) 

also satisfy 

{X,Y,Z)r^{X,Y,Z). (8) 

Suppose we are given random variables X, Y, Z, W satisfying Properties [l]-[3l We now describe 
what nodes 9 and 10 transmit to the destination. Let x", y", 5", be the four sequences that are 
sent on the edges out of nodes 1-4; because of the traitor at most one of these may differ from 
x", y", z^, w^. Let random variables X, Y, Z, W have joint distribution equal to the joint type 
of (x", y", 5", w"). This is a formal definition; these variables do not exist per se in the network, 
but defining them make it convenient to describe the behavior of the code. Since node 9 recevies 
x"',y^,z^, it knows exactly the joint distribution of X,Y,Z. In particular, it can check which 
of ©-([S]) are satisfied for these variables. 

Suppose ([8]) holds. Then all three sequences x"',y'^,z^ are trustworthy, because if a traitor is 
among nodes 1-3, it must have transmitted the true value of its output sequence, or else the 
empirical type would not match, due to Property [21 In this case, node 9 forwards x" to the 
destination, confident that it is correct. Meanwhile, node 10 can also observe X, Y, Z, and so it 
forwards to the destination. 

Now suppose ([8]) does not hold. Then by Property [3l one of ©-dV]) must not hold. Suppose, 
for example, that {X,Y) 7^ (X,Y). Because of our constant composition code construction. 
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this can only occur if either node 1 or 2 is the traitor. Hence, node 3 is honest, so Node 9 may 
forward to the destination without error. Similarly, no matter which pairwise distribution does 
not match, node 9 can always forward the sequence not involved in the mismatch. Meanwhile, 
node 10 may forward to the destination, since in any case the traitor has been localized to 
nodes 1-3. The destination always receives two of the four sequences, both guaranteed correct; 
therefore it may decode. 

B. The Polytope Distribution 

All that remains to prove that rate 2 can be achieved for the Caterpillar network is to show that 
there exists variables X, y, Z, W such that Properties [l]-[3]hold. In fact, this is not quite possible. 
In particular. Property [H implies that X, F, Z, W are pairwise independent. If so. Property |3] 
cannot hold, because we can take X, F, Z to be jointly independent with X ~ X, F ~ F, and 
Z ^ Z. This satisfies ([S])-© but not ([8]). We therefore replace Property [T] with the following 
slight relaxation. 

^glP > 2 - . 

If for every e > 0, there exists a set of random variables satisfying Properties [2]-|4l then by (H]) 
we achieve rate 2. 

The most unusual aspect of the Polytope Code is Property [3] and its generalization, to be 
stated as Theorem [3] in Sec. IVIIIi Therefore, before constructing a distribution satisfying all 
three properties, we illustrate in Table H] a very simple distribution on three binary variables 
variables that satisfy just Property [3l This distribution is only on X, F, Z\ for simplicity leave 
out W , as it is not involved in Property [3l We encourage the reader to manually verify Property [3] 
for this distribution. Observe that X, F, Z as given in Table H] may be alternatively expressed as 
being uniformly distributed on the following polytope: 

e {0,1} : x + y + z = 1}. (9) 

This is a special case of the construction of the distributions in the sequel. 

We now construct a distribution satisfying Properties [21-111 for arbitrarily small e. Take k to be 
a positive integer, and let X, F, Z, W be uniform over the set 

{(x, y, 2;, vS) E {—k, . . . , fc}^ : X + y + z = and 3x — y + 2w = O}. (10) 



17 



TABLE I 

A SIMPLE DISTRIBUTION SATISFYING PR0PERTy[31 
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Fig. 5. An example polytope projected into the [x, y) plane. 



Note that this is the set of integer lattice points in a polytope. 

By the linear constraints in (flOl ). this distribution satisfies Property [2l Now consider Property |4l 
The region of (X, Y) pairs with positive probability is shown in Figure [5l Note that X and Y 
are not independent, because the boundedness of Z and W requires that X and Y satisfy certain 
linear inequalities. Nevertheless, the area of the polygon shown in Figure [5] grows as 0{k'^). 
Hence 

log HjXYZW) _ log0(P) ^ 

log|X| log(2A; + l) - ^ ^ ^ 

where the last inequality holds for sufficiently large k. Thus these variables satisfy Property IH 
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We now consider Property [3] Assuming X, Y, Z satisfy ©-([T]), we may write 

E[{X + Y + Zf] = E [X^ + + ^2 ^ 2XY + 2XZ + 2Y Z] (12) 

= E [X^ + + + 2XY + 2XZ + 2YZ] (13) 

= E[(X + r + Z)2] (14) 

= (15) 

where (fT3]) holds from ©-dV]), and because each term in the sum involves at most two of the 
three variables; and (fT5l) holds because X + F + Z = Oby construction. Hence X + F + Z = 0, 
so we may write 

(X,F,Z) = (X,F,-X-r) (16) 
~ (X, F, -X - F) (17) 

= (x,y,z) (18) 

where (fTTl ) holds by ([5]). This verifies Property [3j and we may now conclude that the distribution 
on X, F, Z, ly satisfies all desired properties, so the induced Polytope Code achieves rate 2 for 
the Caterpillar network. 

The above argument took advantage of the linear constraint X + Y + Z = 0, but this constraint 
was in no way special. Property [3] would hold as long as X, Y, Z are subject to any linear 
constraint with nonzero coefficients for all three variables. 

Observe that when k is large, any pair of the four variables are nearly independent, in that their 
joint entropy is close to the sum of their individual entropies. We have therefore constructed 
something like a (4, 2) MDS code. In fact, if we reinterpret the linear constraints in (flOl) as 
constraints on elements x,y,z,w from a finite field, the resulting finite subspace would be 
exactly a (4, 2) MDS code. This illustrates a general principle of Polytope Codes: any code 
construction on a finite field can be immediately used to construct a Polytope Code, and many 
of the properties of the original code will hold over. The resulting code will be substantially 
harder to implement, in that it involves much longer blocklengths, and more complicated coding 
functions, but additional properties, such as Property [3l may hold. 
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VII. A PoLYTOPE Code for the Cockroach Network 

We return now to the Cockroach network, and demonstrate a capacity-achieving Polytope Code 
for it. We do this not to find the capacity for the network, because we have already done so with 
the simpler code in Sec. |Vl but rather to illustrate a Polytope Code on a network satisfying the 
conditions of Theorem |2l which are of a somewhat different flavor than the Caterpillar network. 

In Sec. lYl we illustrated how performing comparisons and transmitting comparison bits 
through the network can help defeat traitors. In Sec. |VIl we illustrated how a code can be 
built out a distribution on a polytope, and how a special property of that distribution comes into 
play in the operation of the code. To build a Polytope Code for the Cockroach network, we 
combine these two ideas: the primary data sent through the network comes from the distribution 
on a polytope, but then comparisons are performed in the network in order to localize the traitor. 

The first step in constructing a Polytope Code is to describe a distribution over a polytope. 
That is, we define a linear subspace in a real vector field, and take a uniform distribution over 
the polytope defined by the set of vectors with entries in {—k,...,k} for some integer k. The 
nature of this distribution depends on the characteristics of the linear subspace. For our code 
for the Cockroach network, we need one that is equivalent to a (6, 2) MDS code. That is, the 
linear subspace sits in R^, has dimension 2, and is defined by four constraints such that any two 
variables determine the others. One choice for the subspace, for example, would be the set of 
(a, b, c, d, e, /) satisfying 

a + b + c = (19) 
a-b + d = (20) 
a + 2b + e = (21) 
2a + 6 + / = 0. (22) 

Let the random variables A, B, C, D, E, F have joint distribution uniformly distributed over the 
polytope defined by (fT9l) - (|22)) and a, b, c, d,e, f E {—k, . . . ,k}. By a similar argument to that 
in Sec. |Vll for large k, 

HjABCDEF) ^ 
log(2A; + l) ^"-^^ 

We choose a block length n and associate each message with a joint sequence {aT-h^c^d^e^ f^) 

with joint type exactly equal to the distribution of the six variables. For large n and k, we may 



20 



a 




Fig. 6. A capacity-achieving Polytope Code for the Cockroach Network. 

place one sequence a^-f^ on each unit capacity edge in the network and operate near rate 2. 
These six sequences are generated at the source and then routed through the network as shown 
in Fig. |6l For convenience, the figure omits the n superscript, but we always mean them to be 
sequences. 

As in Sec. |Vll we define A, 13, C, D, E, F to have joint distribution equal to the type of the 
six sequences an they actually appear in the network, which may differ from the sequences sent 
by the source because of the adversary. In addition to forwarding one sequence, nodes 4 and 
5 perform more elaborate operations. Like in the code for the Cockroach network described in 
Sec. lYl they each perform a comparison and transmit either = or 7^ depending on whether the 
comparison succeeds. In particular, they compare the types of their received sequences with the 
original distribution. For example, node 4 receives the two sequences 6" and c", from which it 
can construct B and C. If the joint distribution of (B, C) matches that of (5, C), it sends = to 
the destination; if not, it sends 7^. This single bit costs asymptotically negligible rate, so it has 
no effect on the achieved rate of the code for large n and k. Node 5 performs a similar action, 
comparing the distribution of (-D, E) with that of {D,E), and transmitting a comparison bit to 
the destination. 

We now describe the decoding operation at the destination. The first step is to compile a list of 
possible traitors. We denote this list L C {1, . . . ,5}. The destination does this in the following 
way. Since the code is entirely known, with no randomness, the destination determines whether 
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all its received data could be induced if each node were the traitor. That is, it considers each 
possible message, each possible traitor, and each possible set of values on the output edges of 
that traitor. Any combination of these determines the values received at the destination, which 
may be compared to what that the destination has in fact received. If a node i is such that it 
could have been the traitor and induced the set of values received at the destination, for any 
message and any action by node i, then i is put onto L. This process ensures that the true traitor, 
even though it may not be known by the destination, is surely in £>. Note that this procedure 
could in principle be done for any code, not necessarily a Polytope Code. 

Because we define L in this non-constructive manner, our arguments for code correctness 
may sometimes seem backwards. We will make assumptions about L, and from there reason 
about the resulting constraints on what the traitor could have done, even though this is opposite 
to the causal relationship. We do this because it is most convenient to partition possible traitor 
actions based on the L that results. As long as our analysis considers every possible L, we can 
be assured that the code can handle any possible traitor action. 

Once L is determined, the next step in the decoding process is to use L to decide from which 
of the four symbols available at the destination to decode. Since any pair of the six original 
symbols contain all the information in the message, if at least two of the four symbols a, c, d, f 
can be determined to be trustworthy by the destination, then it can decode. The destination 
discards any symbol that was touched by every node in £>, and decodes from the rest. For 
example, if £> — {2}, then the destination discards c, d and decodes from a, /. If £ = {2, 4}, the 
destination discards just c — because it is the only symbol touched by both nodes 2 and 4 — and 
decodes from a,d,f.lfL = {l,..., 5}, then it discards no symbols and decodes from all four. 

The prove the correctness of this code, we must show that the destination never decodes from 
a symbol that was altered by the traitor. This is easy to see if |£| = 1, because in this case 
the destination knows exactly which node is the traitor, and it simply discards all symbols that 
may have been influenced by this node. Since no node touches more than two of the symbols 
available at the destination, there are always at least two remaining from which to decode. 

More complicated is when |£| > 2. In this case, the decoding process, as described above, 
sometimes requires the destination to decode from symbols touched by the traitor. For example, 
suppose node 2 were the traitor, and L = {1,2}. No symbols are touched by both nodes 1 and 
2, so by the decoding rule the destination decodes using all four of its received symbols. In 
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particular, the destination uses c and d to decode, even though both are touched by node 2. To 
prove correctness we must show that node 2 could not have transmitted anything but the true 
values of c and d. What we use to prove this is the fact that L contains node 1, meaning that 
node 2 must have acted in a way such that it appears to the destination that node 1 could be the 
traitor. This induces constraints on the behavior of node 2. The first is that the comparison that 
occurs at node 5 between d and e must succeed. If it did not, then the destination would learn it, 
and conclude that node 1 could not be the traitor, in which case 1 would not be in £ . Hence the 
distribution of (D, E) must match that of {D, E). This constitutes a constraint on node 2 in its 
transmission of d. Moreover, (Z), F) ~ (D, F), because the destination may observe d and /, so 
it could detect a difference between these two distributions if it existed. Because both symbols 
are untouched by node 1 and 1 E the distributions must match. Furthermore, because neither 
e nor / are touched by the traitor node 2, {E, F) ~ {E, F). To summarize: 

{D,E)^{D,E), (24) 

{D,F)^{D,F), (25) 

{E,F)r^{E,F). (26) 

Using these three conditions, we apply Property [3] to conclude that (D, E, F) ~ (D, E, F). We 
may do this because, as we argued in Sec. |Vll Property [3] holds for for any three variables in 
a polytope subject to a single linear constraint with nonzero coefficients on each one. Since we 
have constructed the 6 variables to be a (6, 2) MDS code, this is true here. (In the space defined 
by (fT9l)- (l22)) . the three variables D, E, F are subject to D + E - F = 0.) Since e and / together 
specify the entire message, in order for this three-way distribution to match, the only choice for 
d is the true value of d. Now we have to show that c can also not be corrupted by the traitor. 
Since the only symbol seen by the destination that could be touched by node 1 is a, we must 
have (C, D, F) (C, D, F), or else 1 would not be in £. Again since any two symbols specify 
the entire message, and both d and / are uncorrupted by the traitor, the value for c sent by node 
2 must also be its true value. Therefore the destination will not make an error by using c and d 
to decode. 

The above analysis holds for any L containing {1,2}. That is, if node 2 is the traitor, and 
1 E L, then node 2 cannot corrupt c or d (even if L contains additional nodes). To prove 
correctness of the code, it is enough to demonstrate a similar fact for every pair of nodes: we 
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must show that for every pair of nodes if i is the traitor and j e node i is forced to 

transmit the true value of any symbol that is not also touched by node j. If this can be shown 
for each pair, the destination always decodes correctly by discarding only the symbols touched 
by every node in L. 

Moreover, it is enough to consider each unordered pair only once. For example, as we have 
already performed the analysis for i = 2 and j = 1, we do not need to perform the same analysis 
for i = 1 and j — 2. This is justified as follows. We have shown that when node 2 is the traitor 
and 1 e symbols c and d are uncorrupted. Therefore (^4, (7, D, F) ~ {A, C, D, F). Hence if 
1 e £ and {A, C, D, F) 7^ {A, C, D, F), node 2 cannot be the traitor, so 2 ^ L. Now, if node 
1 is the traitor and 2 G then it must be the case that {A, C,D,F) ~ {A, C,D,F). Since of 
these four symbols only a is touched by node 1, it cannot be corrupted. This same argument 
can apply to any pair of nodes. 

We now complete the proof of correctness of the proposed Polytope Code for the Cockroach 
network by considering all pairs of potential traitors in the network: 

(1.2) : Proof above. 

(1, 3): Suppose node 1 is the traitor and 3 E L. We must show that node 1 cannot corrupt a. 
We have that {A, C, D) ~ [A, C, D), because these three symbols are not touched by 
node 3, and are available at the destination. Since c and d determine the message, this 
single constraint is enough to conclude that node 1 cannot corrupt a. This illustrates 
a more general principle: when considering the pair of nodes if the number of 

symbols available at the destination untouched by both i or j is at least as large as the 
rate of the code, we may immediately conclude that no symbols can be corrupted. In 
fact, this principle works even for finite-field linear codes. 

(1.4) : Follows exactly as (1,3). 

(1.5) : Follows exactly as (1,3). 

(2.3) : Follows exactly as (1,2). 

(2.4) : Suppose node 4 is the traitor and 2 e The only symbol touched by both nodes 1 

and 4 is c, so the destination will decode from a, d, /. But node 4 does not touch any 

of these symbols, so it cannot corrupt them. 

(2.5) : Follows exactly as (2,4). 
(3,4): Follows exactly as (1,3). 
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(3,5): Follows exactly as (1,3). 
(4,5): Follows exactly as (1,3). 

VIII. The Polytope Code 

We now describe the general structure of Polytope Codes and state their important properties. 
Given a matrix F E Z"^'", consider the polytope 

Tfc = {x G : Fx = 0, \xi\ < k for i = 1, . . . ,m} . (27) 

We may also describe this polytope in terms of a matrix K whose columns form a basis for the 
null-space of F. Let X be an m-dimensional random vector uniformly distributed over CPfe. Take 
72 to be a multiple of the least common denominator of the distribution of X and let T"(X) be 
the set of sequences x" with joint type exactly equal to this distribution. In a Polytope Code, 
each message is associated with an element of T"(X). By the theory of types, the number of 
elements in this set is at least 2'^^^^-^^~''^ for any e > and sufficiently large n. Given a message 
and the corresponding sequence x", each edge in the network holds a sequence x" for some 
i = 1, . . . , m. As we have seen in the example Polytope Codes in Sec. |VI] and IVIIl the joint 
entropies for large k can be calculated just from the properties of the linear subspace defined 
by F. The following proposition states this property in general. 
Proposition 1: For any S* C {1, . . . , m} 

lim = mnk( Ks) (28) 

fc^oo log k 

where Ks is the matrix made up of the rows of K corresponding to the elements of S. 

Proof: For any S C {1, . . . ,m}, let ^^(X^) be the projection of Tk onto the subspace 
made up of dimensions S. The number of elements in 7k is Q(k™^'^^'^^). That is, there exist 
constants ci and C2 such that for sufficiently large k 

^^^rank(i^s) < \7^{Xs)\ < C2k'^''^^^^\ (29) 

For 5* = {l,...,m}, because X is defined to be uniform on CP^, (|29|) gives 

HiX) \og\n\ 

lim — ^— ^ = lim — — ^ = rank(A). (30) 

fc-i-oo log k k^oo log k 

Moreover, by the uniform bound 

lim < rank(i^5). (31) 

fc-5>oo log k 
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For any S C {1, . . . , m}, let T C {1, . . . , m} be a minimal set of elements such that rank{Ks^T) = 
rank(_ft'); i.e. such that Xs,t completely specify X under the constraint FX = 0. Note that 

rank(_ft'j') = rank(i^') — rank(_ft'5'). Hence 

lini ^(-^^) = lim ^^^'^^^ - ^(-^^1-^^) (32) 
fc-*-oo log h k^oo log k log k 

> £m _ ^ (33) 

k^oo log k log k 

> rank(K) - rank(irT) (34) 
= rank(ir5). (35) 

Combining (|3T1) with (|35] ) completes the proof ■ 
Recall that in a linear code operating over the finite field F, we may express the elements 
on the edges in a network x G as a linear combination of the message x = i^w, where K 
is a linear transformation over the finite field, and w is the message vector. Taking a uniform 
distribution on w imposes a distribution on X satisfying 

H{Xs) = mnk{Ks) log |F|. (36) 



This differs from (1281) only by a constant factor, and also that (|28l) holds only in the limit 
of large k. Hence, Poly tope Codes achieve a similar set of entropy profiles as standard linear 
codes. They may not be identical, because interpreting a matrix Ks as having integer values 
as opposed to values from a finite field may cause its rank to change. However, the rank when 
interpreted as having integer values can never be less than when interpreted as having finite 
field values, because any linear equality on the integers will hold on a finite field, but not 
necessarily vice versa. The matrix Ks could represent, for example, the source-to-destination 
linear transformation in a code, so its rank is exactly the achieved rate. Therefore, a Polytope 
Code always achieves at least as high a rate as the equivalent linear code. Often, when designing 
linear codes, the field size must be made sufficiently large before the code works; here, sending 
k to infinity serves much the same purpose, albiet only asymptotically. 

In Sec. |VI] and IVII[ we saw that Property [3] played an important role in the functionality of 
the Polytope Codes. The following theorem states the more general version of this property. It 
compromises the major property that Polytope Codes possess and linear codes do not. 
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Theorems (Fundamental Property of Polytope Codes): Let X G R™ be a random vector 

satisfying FX = 0. Suppose a second random vector X e M™ satisfies the following L 
constraints: 

Ai% ~ A;X for / = 1, . . . , L (37) 

where Ai E R"'^"*. The two vectors are equal in distribution if the following hold: 

1) There exists a positive definite C E M"^" and matrices E R"'^"' such that 

L 

F^CF = Y,AfJ:iAi. (38) 

1=1 

I F 1 

2) There exists I* E il, . . . , L} such that , has full column rank. 

[Ai,\ 

Proof: The following proof follows almost exactly the same argument as the proof of 
Property [3] in Sec. |VIl We may write 

m 

E[{FXfC{FX)] = ^E[(A,X)^SKA,X)] (39) 

1=1 

m 

= ^E[(A;X)^SKA,X)] (40) 

1=1 

= E[(FX)^C(FX)] (41) 
= (42) 



where (1391) and (|4T|) follow from (1381) : (1401) follows from (|37I) . and because each term in the sum 
involves AfK. for some /; and (|42l) follows because FX = 0. Because C is positive definite, 
(|42l) implies FX = 0. 

By the second property in the statement of the theorem, there exists Gi E M"*^" and G2 E 

GiF + G2A1. = F (43) 
Hence G2Ai*X. = X, so we may write 

X = GaA^.X (44) 

~ G2A.X (45) 

= X. (46) 
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As an example of an application of Theorem [3l we use it to prove again Property [3] in Sec. IVTl 
Recall that variables X,Y, Z E {—k, . . . ,k} satisfying X + Y + Z = 0, and the three pairwise 
distributions of X, Y, Z match as stated in ©-([T]). In terms of the notation of Theorem [3l we 
have m = 3, L = 3, and 



A, 



A, 



1 1 1 

1 

1 

1 
1 

1 

1 



F 

A, 



(47) 
(48) 

(49) 

(50) 

has rank 3. In 



To satisfy the second condition of Theorem [3l we may set I* = 1, since 
fact, we could just as well have set /* to 2 or 3. To verify the first condition, we need to check 
that there exist for / = 1, 2, 3 and a positive definite C (in this case, a positive scalar, because 
F has only one row) satisfying (|38l) . If we let 



then, for instance. 





0"i,ll 


0";,i2 




0"«,21 


(^1,22 




0-1,11 


0-1,12 


A^E.A, = 


0^1,21 


0^1,22 










expands to 






<yi,u + 0-2,11 


0-1,12 



(51) 








(52) 



"^2,12 

'^AJT.iAi= 0-1,21 0-1,22 + 0^3,11 0-3,12 • (53) 

1=1 

0-2,21 0-3,21 0-2,22 + 0-3,22 

Therefore, for suitable choices of {T.i}f^^, we can produce any matrix for the right hand side of 
(l38l) . We may simply set C = 1 and calculate the resulting matrix for the left hand side, then set 
{^i}f=i appropriately. This allows us to apply Theorem[3]to conclude that {X, Y, Z) ~ (X, Y, Z). 
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Fig. 7. The constraints on the random vector X in Corollaries |2] (left) and [3] (right). Rectangles represent a constraint on the 
marginal distribution of all enclosed variables; lines represent pairwise constraints on the two connected variables. 



In our proof of Theorem |2l we will not use Theorem [3] in its most general form. Instead, we 
state three corollaries that will be more convenient. The first is a generalization of the above 
argument for more than three variables. 

Corollary 1: Let X satisfy FX = for some F G Z^^™ with all nonzero values. If X satisfies 

(X„ X,) ~ (X„ X,) for alH, J = 1, . . . , m (54) 

(X2, ■ ■ ■ , Xjn) ~ {X2, ■ ■ ■ , Xm) (55) 

then X ~ X. 

Proof: We omit the explicit construction of the Ai matrices corresponding to the conditions 
(|54l ). (1551 ). The second condition for Theorem [3] is satisfied by (|55] ). since the linear constraint 
FX = determines Xi given X2---Xm- To verify the first condition, note that from the 
conditions in (|54l ). we may construct an arbitrary matrix on the right hand side of (|38] ) for 
suitable {S^j^i. Therefore we may simply set C = 1. ■ 
Corollary \T\ considers the case with m variables and m — 1 degrees of freedom; i.e. a single 
linear constraint. The following corollary considers a case with m variables and m — 2 degrees 
of freedom. 

Corollary 2: Let F G Z^^™ be such that any 2x2 submatrix of F is non-singular. Let X satisfy 
FX = 0. The non- singular condition on F implies that any m — 2 variables specify the other 
two. Assume that m > 4, and for convenience let Z = (X5, . . . , Xm) and Z = (X5, . . . , Xm). If 
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X satisfies 



(Xi,X2,Z) 


~ (-^1,-^2, Z), 


(56) 




~ (-^3,-^4, Z), 


(57) 


(^1,^3) 


~ (Xi,X3), 


(58) 




~ (X2,X4), 


(59) 


(Xi,X4) 


~ (Xi, X4) 


(60) 



then X ~ X. Fig. |7] diagrams the constraints on X. 

Proof: We prove Corollary [2] with two applications of Corollary [TJ First, consider the group 
of variables (X1X2X4Z). These m — 1 variables are subject to a single linear constraint, as in 
Corollary [U From (l56l) . (|59l) . and (l60l) we have all pairwise marginal constraints, satisfying (|54l) . 
Furthermore, (l56l) satisfies (|55l) . We may therefore apply Corollary [T] to conclude 

(Xi, X2, X4, Z) ~ (Xi, X2, X4, Z). (61) 

A similar application of Corollary \\\ using (l57l) . (l58l) . and (l60l) allows us to conclude 

(Xi,X3,X4,Z) ~ (Xi,X3,X4,Z). (62) 

Observe that (|6T1) and (l62l) share the m variables (Xi, X4, Z), which together determine X2 and 
X3 in exactly the same way that (Xi, X4, Z) determine X2 and X3. Therefore we may combine 
(1611 ) and ([621) to conclude X ~ X. ■ 

All five constraints (I56l)-(l60l) are not always necessary, and we may sometimes apply The- 
orem |3] without (l60l) . However, this depends on an interesting additional property of the linear 
constraint matrix F, as stated in the third and final corollary to Theorem [3l 

Corollary 3: Let F E Z^^™ be such that any 2x2 submatrix of F is non-singular, and let 
X satisfy FX = 0. In addition, assume 

\KxiX2z\ \Kx3X4z\ l-f^XiXszl 1-^X2X42! < (63) 

where again if is a basis for the null space of F, and i^Xg for S C {1, . . . , m} is the matrix 
made up of the rows of K corresponding to the variables {Xi)i^s- If X satisfies (I56l)-(|59|) (Fig. |7] 
diagrams these constraints), then X ~ X. 
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Proof: Either (|56l ) or (1571) satisfies the second condition in Theorem [3l To verify the first 
condition, first let G = J2i ^I^i^i- the four constraints (I56l)-(|59|). each pair of variables 
appears together except for (Xi^X^) and (X2,X3). Therefore, for suitable choices of S^, we 
can construct any G satisfying Gi^4 = 6^2,3 = 6*3,2 = ^4,1 = 0. We must show that such a G 
exists satisfying 

F^GF = G (64) 

for some positive definite G. 

We build G row-by-row. By (|64|) . each row of G is a linear combination of rows of F; i.e. 
it forms the coefficients of a linear equality constraint imposed on the random vector X. Since 
6*14, the first row of G represents a linear constraint on the variables Xi, X2, X^, Z. Since any 
m — 2 variables specify the other two, there is exactly one linear equality constraint on these 
m — 1 variables, up to a constant. This constraint can be written as 

X2 Kx, 



Xs Kx, 



0. 



(65) 



Z Kz 

since the vector Xi, X2, X3, Z forms a linear combination of the columns of Kxi,x2,X3,z- Hence, 
the first row of G is a constant multiple of the coefficients in (l65l) . In particular, 

Gi,! = a\Kx2X3z\, (66) 
Gi,2 = -a\Kx-,X3z\ (67) 

for some constant a. Since (^2,3 = 0, the second row of G represents the linear constraint on 
Xi,X2,X^, Z. Using similar reasoning as above gives 

G2,i = P\Kx2X^z\, (68) 
G2,2 = -P\Kx,x,z\ (69) 



for some constant /3. Moreover, by (l64l) G is symmetric, so Gi,2 = 6*2,1, and by (l67l) and (|68 

\Kx1X3z' 



f3 



\K 



rCt. 



(70) 



A"2-X^4Z I 
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Positive definiteness of C is equivalent to positive definiteness of the upper left 2x2 block of 
G, so the conditions we need are 

< Gi^i = a\Kx,x,z\, (VI) 
< GiiGao - ^1,2^2,1 (72) 



\KX2xaz 




KxiXiZ 




Kx^Xzz\ 




KX2X4Z 





— \KXIX3Z 



(73) 



We may choose a to trivially satisfy (|7TI) . and (1731) is equivalent to 

l-^XiXszl \Kx2Xiz\[\Kx2X-iz\ \KxxXaz\ — \Kx2Xaz\ l-^XiXszl ) >0 (74) 



which may also be written as (1631) . ■ 
The necessity of satisfying (1631) in order to apply Theorem [3] substantially complicates code 
design. When building a linear code, one need only worry about the rank of certain matrices; 
i.e. certain determinants need be nonzero. Here, we see that the signs of these determinants may 
be constrained as well. 

IX. Proof of Theorem [2] 

To prove Theorem |2l we need to specify a Polytope Code for each network satisfying 
conditions 1-3 in the statement of the theorem. This involves specifying the linear relationships 
between various symbols in the network, the comparisons that are done among them at internal 
nodes, and then how the destination uses the comparison information it receives to decode. 
We then proceed to prove that the destination always decodes correctly. The key observation 
in the proof is that the important comparisons that go on inside the network are those that 
involve a variable that does not reach the destination. This is because those symbols that do 
reach the destination can be examined there, so further comparisons inside the network do not 
add anything. Therefore we will carefully route these non-destination symbols to maximize the 
utility of their comparisons. In particular, we design these paths so that for every node having 
one direct edge to the destination and one other output edge, the output edge not going to the 
destination holds a non-destination variable. The advantage of this is that any variable, before 
exiting the network, is guaranteed to cross a non-destination variable at a node where the two 
variables may be compared. The existence of non-destination paths with this property depends 
on the planarity of the network. This is described in much more detail in the sequel. 
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Notation: For an edge e e E, with e = where i,j G V^, let head(e) = i and tail(e) = j. 

For a node i E V, let £in(«) be the set of edges e with tail(e) = i, and let £out(0 be the set of 
edges e with head(e) = i. Let Kin(i) be the set of input neighbors of i; that is, the set of head(e) 
for each e G £in(0- Similarly, let !Nout(«) be the set of output neighbors of i. For integers a,b, 
let Vq b be the set of nodes with a inputs and b outputs. We will sometimes refer to such nodes 
as a-to-6. For / G {1,2}, let I = 2 — 1. A path is defined as an ordered list of edges ei, . . . , Cfc 
satisfying tail(ez) = head(e/+i) for Z = 1, . . . , /c — 1. The head and tail of a path are defined as 
head(ei) and tail(efc) respectively. A node i is said to reach a node j if there exists a path with 
head i and tail j. By convention, a node can reach itself. 

Consider an arbitrary network satisfying the conditions of Theorem [21 By condition (3), 
no node has more output edges than input edges. Therefore the min-cut is that between the 
destination and the rest of the network. Let M be the value of this cut; i.e., the number of edges 
connected to the destination. We now state a lemma giving instances of the cut-set upper bound 
on capacity in terms of quantities that make the bound easier to handle than Theorem \T\ itself. 
We will subsequently show that the minimum upper bound given by Lemma [U is achievable 
using a Polytope Code; therefore, the cut-set bound gives the capacity. 

Lemma 1: For i,j G V, let dij be the sum of |£in(A;)| — |£out(^)| for all nodes k reachable 
from either i or j, not including i or j. That is, if k is a-to-b, it contributes a — 6 to the sum. 
Recall that this difference is always positive. Let Cj be the total number of output edges from 
node i, and let Cj be the number of output edges from node i that go directly to the destination. 
For any distinct pair of nodes ii, 12, 

C<M-ei,-ei,. (75) 
Moreover, if there is no path between ii and i2, 

C < M + di^^i^ - Ci^ - Ci^. (76) 

Proof: Applying Theorem [H with A = V \ {D}, T = {ii,i2} immediately gives (1751) . To 
prove (l76l) . we apply Theorem [T] with T = {ii,i2}, and 

A = {k eV : k is not reachable from ii or {2} U {ii,i2}- (77) 

Observe that there are no backwards edges for the cut A, because any node in A'^ is reachable 
from either ii or i2, so for any edge (j, k) with j G A^, k is also reachable by from ii or i2, so 
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k is also not in A. Therefore we may apply Theorem [T] Since all output neighbors of ii and ^2 
are not in A, each output edge of ii and Z2 crosses the cut. Hence (O becomes 

C <\{eeE : head(e) e A, tail(e) ^ A}| - ci - Ca. (78) 

Since no node in the network has more output edges than input edges, the difference between 
the first term in (1781) — the number of edges crossing the cut — and M is exactly the sum of 

|£in(A;)| - |£out(A;)| for all k e A^. Hence 

\{ee E: head(e) G A, tail(e) ^ A}\ - M = di,,i^. (79) 

Combining (|78]) with ^ gives ■ 
Next, we show that we may transform any network satisfying the conditions of Theorem [2] 
into an equivalent one that is planar, and made up of just 2-to-2 nodes and 2-to-l nodes. We will 
go on to show that the upper bound provided by Lemma [T] is achievable for any such network, so 
it will be enough to prove that a transformation exists that preserves planarity, does not reduce 
capacity, and does not change the bound given by Lemma [T] 

We first replace any a-to-6 node i with a cascade of a — 6 2-to-l nodes followed by a b-to-b 
node. This transformation is illustrated in Fig. [81 Denote the b-to-b node in the transformation 
i*. Since no node in the original network has more than two output edges, the resulting network 
contains only 1-to-l nodes, 2-to-2 nodes, and 2-to-l nodes. We will shortly argue that the 1- 
to-1 nodes may be removed as well. Certainly these transformations maintain the planarity of 
the network. Moreover, any rate achievable on the transformed network is also achievable on 
the original network. This is because if node i is transformed via this operation into several 
nodes, any coding operation performed by these nodes can certainly be performed by node i. 
Additionally, the traitor taking control of node i in the original network does exactly as much 
damage as the traitor taking control of i* in the transformed network, since it controls all edges 
sent to other nodes. Now consider the minimum upper bound given by Lemma \T\ after this 
transformation. The only nodes with positive ej values will be i* nodes, and e^. = Cj. Hence 
(l75l) cannot change. In (l76l) . if we take il and then the bound is the same in the transformed 
network. Taking one of the 2-to-l nodes instead of a i* node cannot result in a lower bound, 
because they have no more output edges, so no higher c values, and no fewer reachable nodes 
with fewer outputs than inputs, so no smaller d values. Therefore, the minimal bound given by 
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(1761 ) for the transformed network is the same as that of the original network. Moreover, in the 
transformed network is equal simply to the number of 2-to-l nodes reachable from ii or 
Z2 not including ii,i2- 

We may additionally transform the network to remove 1-to-l nodes, simply be replacing the 
node and the two edges connected to it by a single edge. The traitor can always take over the 
preceding or subsequent node and have at least as much power. The only exception is when the 
1-to-l node is connected only to the source and destination. In this case, instead of removing 
the node, we may add a additional edge to it from the source, turning it into a 2-to-l node. Such 
a transformation does not change the capacity, nor the planarity or the Lemma [U bounds. 

We also assume without loss of generality that all nodes in the network are reachable from 
the source. Certainly edges out of these nodes cannot carry any information about the message, 
so we may simply discard this portion of the network, if it exists, without changing the capacity. 

We will show that the smallest bound given by Lemma [U is achievable using a Polytope Code. 
If we take ii and Z2 to be two nodes with at least one direct link to the destination, (1751) gives 
that the capacity is no more than M — 2. Moreover, since Cj < Cj < 2 for any node i, neither 
(1751) nor (1761) can produce a bound less than M — 4. Therefore the minimum bound given by 
Lemma [H can take on only three possible values: M — 4, M — 3, M — 2. It is not hard to see that 
M — 4 is trivial achievable; indeed, even with a linear code. Therefore the only interesting cases 
are when the cut-set bound is Af — 3 or M — 2. We begin with the latter, because the proof is 
more involved, and contains all the necessary parts to prove the M — 3 case. The M — 3 proof 
is subsequently given in Section IIX-E[ 

Assume that the right hand sides of (1751) and (1761) are never smaller than M — 2. We describe 
the construction of the Polytope Code to achieve rate M — 2 in several steps. The correctness 
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of the code will be proved in Lemmas [JHU which are stated during the description of the 
construction process. These Lemmas are then proved in Sections IIX-Aj4lX^ 

1) Edge Labeling: We first label all the edges in the network except those in £in(D). These 
labels are denoted by the following functions 

0:E\£i„(D)^V2,i (80) 
V^:E\£,„(Z})^{0,1}. (81) 

For a 2-to-l node v, let A(f) be the set of edges e with 0(e) = v. The set A(^;) represents the 
edges carrying symbols that interact with the non-destination symbol that terminates at node v. 
The set of edges with 0(e) = v and ^/'(e) = 1 represent the path taken by the non-destination 
symbol that terminates at node v. The following Lemma states the existence of labels 0, if) with 
the necessary properties. 

Lemma 2: There exist functions and ip with the following properties: 

A The set of edges e with 0(e) = v and il){e) = 1 form a path. 

B If 0(e) = V, then either tail(e) = f or there is an edge e' with head(e') = tail(e) and 

0(e') = V. 

C For every 2-to-2 node i with output edges ei,e2, either ip{ei) = 1, ip{e2) = 1, or 

0(ei) ^ 0(62). 

Note that if property (B) holds, A(t>) is a union of paths ending at v. From property (A), the 
edges on one of these paths satisfy ijj{e) = 1. 

2) Internal Node Operation: Assume that and ij) are defined to satisfy properties (A)-(C) in 
Lemma [2l Given these labels, we will specify how internal nodes in the network operate. Every 
edge in the network will hold a symbol representing a linear combination of the message, as 
well as possibly some comparison bits. We also define a function 

p:E->{l,...,|£o,,(5)|} (82) 

that will serve as an accounting tool to track symbols as they pass through the network. We 
begin by assigning distinct and arbitrary values to p(e) for all e G £out('S') (p therefore constitutes 
an ordering on £out(5')). Further assignments of p will be made recursively. This will be made 
explicit below, but if a symbol is merely forwarded, it travels along edges with a constant p. 
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When linear combinations occur at internal nodes, p values are manipulated, and p determine 
exactly how this is done. 

For every node i with 2 input edges, let /i, /2 be these edges. If i is 2-to-2, let ei, 62 be its 
two output edges; if it is 2-to-l, let e be its output edge. If 0(/i) = 4>{f2)^ then node i compares 
the symbols on /i and /2. If node i is 2-to-2, then 0(e;) = 0(/i) for either / = 1 or 2. Node 
i transmits its comparison bit on e;. If node i is 2-to-l, then it transmits its comparison bit on 
e. All 2-to-2 nodes forward all received comparison bits on the output edge with the same (j) 
value as the input edge on which the bit was received. All 2-to-l nodes forward all received 
comparison bits on its output edge. 

We divide nodes in V2,2 into the following sets. The linear transformation performed at node 



i will depend on which of these sets it is in. 

Wi = e V2,2 : = ^(/2) = 0, ^ 0(/2)} (83) 

W2 = e V2,2 : = ^(/2) = 0, 0(/2) = 0(/2)} (84) 

W3 = e V2,2 : ^{h) = 1 or ^{h) = 1} (85) 



We will sometimes refer to nodes in W2 as branch nodes, since they represent branches in 
A(0(/i)). Moreover, branch nodes are significant because a failed comparison at a branch node 
will cause the forwarding pattern within A(0(/i)) to change. For an edge e, denotes the 
symbol transmitted on e. The following gives the relationships between these symbols, which 
are determined by internal nodes, depending partially on the comparison bits they receive. For 
each node i, the action of node i depends on which set it falls in as follows: 

• Wi: Let / be such that (j){ei) = </)(/i). The symbol on /i is forwarded to ei, and the symbol 

on /2 is forwarded onto ej. Set p{ei) = p(/i), and p(e|-) = p(/2)- 
. W2: Let / be such that (f){ei) = 0(/i) = 0(/2). Let /' be such that p{fi>) < p{fp). We will 
show in Lemma [3] that our construction is such that p(/i) 7^ p(/2) at all nodes, so /' is well 
defined. If neither /i nor /2 hold a failed comparison bit, the output symbols are 

X,, =7,,iX^, +7,,2X^, (86) 
Xe, = Xf^, (87) 
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where coefficients 7i,i,7i,2 are nonzero integers to be chosen later. Set output p values to 

p{ei) = p{fp) (88) 
P(er)=p(/r). (89) 

Note that the symbol on the input edge with smaller p value is forwarded without linear 
combination. If the input edge /// reports a failed comparison anywhere previously in 
A(0(/i)), then dST]) changes to 

Xe, = Xf-,. (90) 

• W3: Let / be such that ip{fi) = 1, and /' be such that ■?/'(e//) = 1 and 0(6;/) = (p{fi). 
The symbol on fi is forwarded to e//, and the symbol on fj is forwarded to ep, with the 
following exception. If </)(/i) = 0(/2) and there is a failed comparison bit sent from fj, 
then the forwarding swaps: the symbol on // is forwarded to ep, and the symbol on /[ 
is forwarded to e//. Set p{eii) = p{fi) and p(ep) = p(/p). Again, p is consistent along 
forwarded symbols, but only when all comparisons succeed. 

• V2X- Let / be such that ipi^fi) = 1. The symbol from /[ is forwarded on e, unless there is 
a failed comparison bit sent from fj, in which case the symbol from fi is forwarded on e. 
Set p(e)=p(/p). 

See Fig. |9] for an illustration of the linear transformations performed at internal nodes and how 
they change when a comparison fails. The following Lemma gives some properties of the internal 
network behavior as prescribed above. 
Lemma 3: The following hold: 

1) For any integer a G {1, . . . , ISoutlS)!}, the set of edges with e with p(e) = a form a path 
(we refer to this in the sequel as the p = a path). Consequently, there is no node i with 
input edges /i, /s such that p{f^) = p{f2). 

2) If there are no failed comparisons that occur in the network, then the linear transformations 
are such that the decoder can decode any symbol in the network except those on non- 
destination paths. 

3) Suppose a comparison fails at a branch node k with input edges /i, /2 with v = 0(/i) = 
4>{f2)- Assume without lack of generality that p(/i) < p(/2)- The forwarding pattern within 
A(f ) changes such that symbols sent along the p = p(/2) path are not decodable at the 
destination, but what was the non-destination symbol associated with v is decodable. 
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a, 6, c 
6 




Fig. 9. An example of the linear transformations performed in A{v) for some v (labeled as such). Solid edges denote <j!>(e) = v, 
dashed edges denote <j!>(e) 7^ v. Thick edges denote tpie) = 1. Near the head of each edge is the corresponding p value. Also 
shown is the symbol transmitted along that edge, given initial symbols a-i at the furthest upstream edges in the network. When 
several symbols are written on an edge, this indicates that the edge carries a linear combination of those symbols. The symbols 
indicated in brackets are those carried by the edges when the comparison at the indicated black node fails. Symbols on edges 
labeled without brackets do not change when the comparison fails. 

3) MDS Code Construction: The rules above explain how the symbols are combined and 
transformed inside the network. In addition, when the initial set of symbols are sent into the 
network from the source, they are subject to linear constraints. We now describe exactly how 
this is done. Assume that no comparisons fail in the network, so the linear relationships between 
symbols are unmodified. For a 2-to-l node v, let e* be the edge with 0(e*) = v, ^(e*) = 1, and 
tail(e*) = f ; i.e. it is the last edge to hold the non-destination symbol terminating at v. Observe 
that it will be enough to specify the linear relationships among the symbols on {e* : v G V2,i} 
as well as the M edges in Zia{D). These collectively form the Polytope Code equivalent of a 
(M+ 1^2,1 1, M — 2) MDS code. We must construct this code so as to satisfy certain instances of 
(l63l) . so that we may apply Theorem [3] as necessary. The following Lemma states the existence 
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of a set of linear relationships among the M + 1^2,1! variables with the required properties. 

Lemma 4: For each 2-to-l node v, let E{v) be the set of edges e with tail(e) = D such that 
there is an edge e' with tail(e') = head(e), 0(e') = v, and ip{e') = 1. That is, the symbol on 
e, just before being sent to the destination, was compared against the non-destination symbol 
associated with v. Note that any edge e e £in(^) is contained in E{v) for some 2-to-l node v. 
There exists a generator matrix K e '^m+\V2,i\xm-2 ^^here each row is associated with an edge 
in {el : V e V2,i} U £in(-D) such that for all vi,V2 G V2,i and all /i e E{vi),f2 G E{v2), the 
constraints 

(X^„X;„Z)~(X;„X^„Z) (91) 

(93) 

(Xf,,XeiJ^(Xf,,Xei^) (94) 

imply 

(-'^/i > ^f2 > -'^e;^ , ^e;^ Z) ~ (^/i , , Xe*^ , Xg*^ Z) (95) 

where 

Z=(Xe:ee£in(D)\{/i,/2}). (96) 

4) Decoding Procedure: To decode, the destination first compiles a list L CV of which nodes 
may be the traitor. It does this by taking all its available data: received comparison bits from 
interior nodes as well as the symbols it has direct access to, and determines whether it is possible 
for each node, if it were the traitor, to have acted in a way to cause these data to occur. If so, 
it adds this node to L. For each node i, let Ki be the linear transformation from the message 
vector W to the symbols on the output edges of node i. With a slight abuse of notation, regard 
Kd represent the symbols on the input edges to D instead. For a set of nodes S cV, let Kd±s 
be a basis for the subspace spanned by orthogonal to 

f|span(X,_z,). (97) 
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The destination decodes from -R'd.l^W. If i is the traitor, it must be that i E L, so 



rank{K d±j:) >M- dim p| span(irj) 



(98) 



> M 



rank(_K",;) 



(99) 



> M 



2 



(100) 



where we used the fact that node i has at most two output edges. Since Kd±c has rank at 
least M — 2, this is a large enough space for the destination to decode the entire message. The 
follow Lemma allows us to conclude that all variables in the subspace spanned by Kd±l are 
trustworthy. 

Lemma 5: Consider any pair of nodes Suppose i is the traitor, and acts in a way such 
that j E L. Node i cannot have corrupted any value in K£)j_{i jyW. 

A. Proof of Lemma |2] 

We begin with 0(e) = V^(e) =0 for all edges e, and set and ^ progressively. First we 
describe some properties of the graph (V, E) imposed by the fact that the right hand sides of 
(1751) and (1761) are never less than M — 2. 

Given a 2-to-l node v, let r^, be the set of nodes for which v is the only reachable 2-to-l 
node. Note that other than v, the only nodes in are 2-to-2. Moreover, if v can reach another 
2-to-l node, Vy is empty. We claim that r^, forms a path. If it did not, then there would be 
two 2-to-2 nodes ii,i2 E for which there is no path between them. That is, di^^i^ = 1 and 
Cj^ = = 2, so (1761) becomes C < M — 3, which contradicts our assumption that the cut-set 
bound is M - 2. 

Furthermore, every 2-to-2 node must be able to reach at least one 2-to-l node. If not, then 
we could follow a path from such a 2-to-2 node until reaching a node ii all of whose output 
edges lead directly to the destination. Node ii cannot be 2-to-l, so it must be 2-to-2, meaning 
=2. Taking any other node Z2 with a direct link to the destination gives no more than M — 3 
for the right hand side of (1751) . again contradicting our assumption. 

The first step in the edge labeling procedure is to specify the edges holding non-destination 
symbols; that is, for each 2-to-l node v, to specify the edges e for which 0(e) = v and 'ip{e) = 1. 
To satisfy property (A), these must form a path. For any node i E 7^in{D), the output edge of 
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i that goes to the destination has no value, so to satisfy property (C), the other output edge 
e must satisfy ip{e) = 1. Moreover, by property (B), if 0(e) = v, then there is a path from 
head(e) to v. Hence, if i G V2,2 H for some 2-to-l node v, then it is impossible for the two 
output edges of i to have different values; hence, by property (C), one of its output edges e 
must satisfy tp{e) = 1. Therefore, we need to design the non-destination paths so that they pass 
through r^, for each v, as well as each node in ?\fin(D). 

For each 2-to-l node v, we first set the end of the non-destination path associated with v to 
be the edges in Ty. That is, for an edge e, if head(e), tail(e) G F^, set ^/'(e) = 1 and 0(e) = v. 
Now our only task is to extend the paths backwards such that one is guaranteed to pass through 
each node in !Nin(D). 

Construct an embedding of the graph (V, E) in the plane such that S is on the exterior face. 
Such an embedding always exists ifTSl . If we select a set of edges making up an undirected 
cycle — that is, edges constituting a cycle on the underlying undirected graph — then all nodes in 
the network not on the cycle are divided into those on the interior and those on the exterior, 
according to the planar embedding. Take i,j G !Nin(-D) such that i can reach j, and let Qij be 
the undirected cycle composed of a path from i to j, in addition to the edges {i, D) and (j, D). 
We claim that if a node k G ^^[^{D) is on the interior of Cj j, then it is reachable from i. Since 
S is on the exterior face of the graph, it must be exterior to the cycle Cj ,,. There exists some 
path from 5* to k, so it must cross the Cjj at a node j' . Observe that j' must be on the path 
from i to j, so it is reachable from i. Therefore i can reach j' and j' can reach k, so i can reach 
k. This construction is diagrammed in Fig. [lOl 

We may travel around node D in the planar embedding, noting the order in which the nodes 
!Nin(D) connect to D. Call this order mi, . . . , um- Take any i G 3\fin(-D), and suppose i = ui. We 
claim that the set of nodes in ?\fin(-D) reachable from ui forms a contiguous block around ui 
in the {u} ordering, where we regard ui and um as being adjacent, so two contiguous blocks 
containing ui and um is considered one contiguous block. 

Suppose this were not true. That is, for some i G ?\fin(-D) there exists a j G Kin(D) reachable 
from i that is flanked on either side in the {u} ordering by nodes ki, k2 G Kin(Z}) not reachable 
from i. The order in which these four nodes appear in {u} in some cyclic permutation or 
reflection of 

{Z,k,,j,k2). (101) 
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Fig. 10. A diagram of the planar embedding being used to prove that a node k G !Nin(D) on the interior of d.j is reachable 
from i. Solid lines are single edges; dashed lines represent paths made up of possibly many edges. Thick lines correspond to 
edges in dj. 

Neither ki nor k2 can be on the interior of C^j, because, as shown above, any such node is 
reachable from i. However, if they are both on the exterior, then the order in (IIOII) cannot occur, 
because D is on the boundary of Cj ., . 

By contiguity, if a node i E J^i^^D) can reach any other node in J^ia{D), it can reach a node 
immediately adjacent to it in the {u} ordering. Suppose i can reach both the node ji G IN"in(D) 
immediately to its left and the node j2 E J^in{D) immediately to its right. We show that in fact 
i can reach every node in J^i^^D). In particular, there can be only one such node, or else there 
would be a cycle. Node i has only two output edges, one of which goes directly to D. Let i' be 
the tail of the other. Both ji and j2 must be reachable from i'. 

We claim it is impossible for both ji to be exterior to Gij^ and j2 to be exterior to Cjjj. 
Suppose both were true. We show the graph must contain a cycle. Let C be the undirected cycle 
composed of the path from i' to ji, the path from i' to j2, and the edges (ji, D), (j2, D)- Every 
node on C is reachable from i. Since both ji is exterior to Gij^ and j2 is exterior to Gij^, it is 
easy to see that i must be on the interior of C. Therefore any path from 5 to z must cross the 
cycle at a node k', reachable from i. Since k' is on a path from S to k', i is also reachable from 
k', so there is a cycle. See Fig. [TT]for a diagram of this. 

Therefore, we may assume without loss of generality that j2 is in the interior of Cj^^. Suppose 
there were a node j-^ E J^ia{D) not reachable from i. Node must be on the exterior of Ciji, 
because we have shown that nodes in 3\fin(-D) on the interior are reachable from i. Therefore, 
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Fig. 11. A diagram of the planar embedding being used to prove that a node reaching its two neighbors in Kin(-D) can reach 
every node in Km(-D). SoUd Unes are single edges; dashed lines represent paths made up of possibly many edges. Thick lines 
correspond to the undirected cycle 6. Undirected cycles Cij^ and Cij^ are indicated. 



in the {u} order, these four nodes must appear in some cyclic permutation or reflection of 
31,32)- However, this is impossible, because both ji and 32 were assumed to be adjacent 
to i. Therefore, i can reach every node in ?srin(-D). 

Take a node i that can reach 2-to-l nodes f 1, V2 G 3\fin(-D). Suppose that i cannot reach every 
node in !Nin(D). Therefore, the nodes it can reach in in ?\fin(D) are either entirely to its right or 
entirely to its left in the {u] ordering, or else, by contiguity, node i would be able to reach the 
adjacent nodes on both sides. Suppose without loss of generality that they are all to its right, 
and that V2 is further to the right than vi. We claim that vi is on the interior of Qi^v2- Suppose 
it were on the exterior. By contiguity, every node in 3Nfin(-D) on the exterior of Ci,„2 must be 
reachable from i. Since we have already argued that every node in Nin(-D) on the interior of 
Cj,„2 is reachable from i, this means i can reach every node in !Nin(-D), which we have assumed 
is not the case. 

Therefore, vi is on the interior of Qi,v2- We may construct a path from S io vi, passing through 
all nodes in r„^. This path must cross C^^^j at a node k, reachable from i. Node 3 can reach 
both vi and V2, so it cannot be in F^j. However, 3 is on a path passing through F^^, so it can 
reach all nodes in F^^. Therefore there exists a path from i io vi, passing through F^^. 

If i can reach every node in ?sfin(-D), then as shown above, either vi is in the interior of Ci,„^, 
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or V2 is in the interior of Gj^^j. Therefore, by the same argument to that just used for the case 
that i cannot reach every node in 3^1^(0), there is either a path from i to Vi through or a 
path from i to V2 through Ty^- 

Fix a 2-to-l node vi G 'Nin{D). Consider the set of nodes that are: 

• contained in V2,2 H 'NmiD), 

• not in for any 2-to-l node v, 

• can reach vi, 

• cannot reach any other node also satisfying the above three conditions. 

We claim there are at most two such nodes. Suppose there were two such nodes ii,i2 both to 
the left of Vi in the {u} ordering. If ii were further to the left, then ii could reach i2, since ii 
can reach vi and the nodes reachable from ii must form a contiguous block. Hence ii would 
not qualify. Therefore there can be at most one such node to the left of vi and at most one to 
the right. Denote these two nodes i and j respectively, if they exist. By contiguity, every node 
satisfying the first three conditions must be able to reach either i or j. Moreover, all such nodes 
to the left of vi form a single path ending in i, and those on the right form a single path ending 
in j. We will proceed to extend two non-destination paths backwards to i and j. Then, we may 
further extend these two paths backwards through all nodes in ^2,2 n J^in{D) that can reach vi, 
and then backwards to the source on arbitrary paths. Hence, we need only find paths from i to 
the head of Ty for some v, and a distinct one of the same for j. 

Both i and j can reach at least one 2-to-l node other than vi. Suppose i can reach another 
2-to-l node V2 e Nin(-D). By the argument above, there is a path from i to the leftmost of 
vi,V2 through F^,^ or T^^ respectively. Similarly, if j can reach a 2-to-l node G 3\fin(Z5) with 
^3 7^ Vi, there is a path from j to the rightmost of ^1,^3, through the associated F. This is true 
even if V2 — V3. 

Suppose there is no 2-to-l node in ^^(-D) reachable from node i other than vi. There still 
must be a 2-to-l node V2 reachable from i, though V2 ^ Kin(-D). Since V2 is not adjacent to 
the destination, it must be able to reach a 2-to-l node that is. Therefore T^^ — 0, so any path 
from i to V2 trivially includes F^,,. If j can also reach no 2-to-l nodes in 3sfin(-D) other than 
t>i, there must be some 2-to-l node ^ 3\fin(D) reachable from j. We may therefore select 
non-destination paths from i to V2 and j to V3, unless ^2 = ^3. This only occurs if this single 
node is the only 2-to-l node other than vi reachable by either i or j. We claim that in this case. 
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either i or j can reach the tail of F^^ . Therefore we may extend the non-destination path for vi 
back to one of i or j, and the non-destination path for V2 = to the other. Every node can 
reach some 2-to-l node in J^in{D), so V2 can reach vi, or else i and j would be able to reach 
a different 2-to-l node in T^i^^D). By a similar argument to that used above, vi must be on the 
interior of the undirected cycle composed of the path from i to ^2, the path from j to V2, and 
the edges {i,D), (j, D). If not, vi would not be between i and j in the {u} ordering. Note this 
is true even if i can reach j or vice versa. Since S must be exterior to this cycle, any path from 
S to Vi including F^^ must cross either the path from i to V2 or j to V2 at a node k. Node k 
must be able to reach the head of V^^ , so either i or j can reach V^^ . 

Once the non-destination paths are defined, we perform the following algorithm to label other 
edges so as to satisfy property (C). We refer to an edge e as labeled if 0(e) ^ 0. We refer to a node 
as labeled if any of its output edges are labeled. Any node unlabeled after the specifications of 
the non-destination paths must not be in Kin(-D), and must be able to reach at least two different 
2-to-l nodes. 

1) For any edge e such that there exists an e' E £out(tail(e)) with V'(e') = 1, set 0(e) = 0(e'). 
Observe now that any path eventually reaches a labeled edge. Furthermore, the tail of any 
unlabeled edge cannot be a node contained in F^ for any v, so it can lead to at least two 
2-to-l nodes. 

2) Repeat the following until every edge other than those connected directly to the destination 
is labeled. Consider two cases: 

• There is no 2-to-2 node with exactly one labeled output edge: Pick an unlabeled node 
i. Select any path of unlabeled edges out of i until reaching a labeled node. Let v be 
the label of a labeled output edge from this node. For all edges e on the selected path, 
set 0(e) = V. Observe that every node on this path was previously an unlabeled 2-to-2 
node. Hence every node on this path, except the last one, has exactly one labeled 
output edge. 

• There is a 2-to-2 node i with exactly one labeled output edge: Let vi be the label 
on the labeled output edge. Select any path of unlabeled edges beginning with the 
unlabeled output edge from i until reaching a node with an output edge labeled V2 
with V2 ^ vi. This is always possible because any unlabeled edge must be able to 
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lead to at least two 2-to-l nodes, including one other than Vi. For all edges e on the 
selected path, set 0(e) = t>2. Observe that before we labeled the path, no node in the 
path other than the last one had an output edge labeled t>2, because if it did, we would 
have stopped there. Hence, after we label the path, if a node now has 2 labeled output 
edges, they have different labels. 
Note that in the above algorithm, whenever an edge e becomes labeled, if there was another 
edge e' with head(e) = head(e'), either e' was unlabeled, or 0(e) 7^ 0(e'). Therefore, the final 
values satisfy property (B). 

B. Proof of Lemma \3\ 

Observe that for any 2-to-2 node, the two p values on the input edges are identical to the two 
p values on the output edges. For a 2-to-l node, the p value on the output edge is equal to the p 
value on one of the input edges. Therefore beginning with any edge in £out('S'), we may follow 
a path along only edges with the same p value, and clearly we will hit all such edges. Property 
(1) immediately follows. 

Property (2) follows from the fact that 2-to-2 nodes always operate such that from the symbols 
on the two output edges, it is possible to decode the symbols on the input edges. Therefore the 
destination can always reverse these transformations to recover any earlier symbols sent in the 
network. The only exception is 2-to-l nodes, which drop one of their two input symbols. The 
dropped symbol is a non-destination symbol, so it is clear that the destination can always decode 
the rest. 

We now prove property (3). We claim that when the comparison fails at node k, it is impossible 
for the destination to decode Xf^. We may assume that the destination has direct access to all 
symbols on edges immediately subsequent to edges in A(t'). This can only make Xf^ easier to 
decode. Recall that p(/i) < p(/2), so Xj^ is forwarded directly on the output edge of k not in 
A(t>). Therefore the destination can only decode Xj,^ if it can decode the symbol on the output 
edge of k in A(t>). Continuing to follow the path through A(t'), suppose we reach an edge ei 
with tail(ei) = k' , where k' is a branch node. Let 62 be the other input edge of k' . Even if 
p(ei) < p(e2), meaning k' would normally forward X^^ outside of A(i;), because ei carries a 
failed comparison bit, k' will instead forward X^^ outside of A(f). Again, the destination can 
only decode Xf^ (or equivalently if it can decode the symbol on the output edge of k' in 
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A{v). If we reach a node interacting with the non-destination symbol associated with v, then 
because of the failed comparison bit, the formerly non-destination symbol is forwarded outside 
of A(v) and the symbol to decode continues traveling through A(t>). It will finally reach v, at 
which point it is dropped. Therefore it is never forwarded out of A{v), so the destination cannot 
recover it. 

C. Proof of Lemma E] 

From Corollary [3l it is enough to prove the existence of a matrix satisfying 

\KeZ^K,.7.\ \Kf,J,,z\ l^e^^J.zl |i^eS^,/„z| < 0. (102) 

We construct a Vandermonde matrix K to satisfy (|102l) for all f i, f 2 and all /i, /2 in the following 
way. We will construct a bijective function (an ordering) a given by 

a:{el:ve V2,i} U n,,{D) ^ {1, . . . , M + |V2,i|}. (103) 

For each v E V2,i, set «(e*) to an arbitrary but unique number in 1, . . . , IV2 i|. We may now 
refer to a 2-to-l node as a^^{a) for an integer a G {1, . . . , |V2,i|}. Now set a{e) for e G £in(-D) 
such that, in a order, the edge set {e* : v G ^2,1} U [N"in(D) is written 

S(a-i(|V2,i|)), S(a-i(|V2,i| - 1)), ... , E{a-\l)). (104) 

That is, each S(f ) set is consecutive in the ordering, but in the opposite order as the associated 
non-destination edges e*. Now let K be the Vandermone matrix with constants given by a. That 
is, the row associated with edge e is given by 

1 a(e) a(e)2 ■ ■ ■ a(e)*^-3 ] . (105) 

We claim the matrix K given by (11051) satisfies (11021) . Fix vi,V2, and /i G H(fi), /2 G H(f2). 
Due to the Vandermonde structure of K, we can write the determinant of a square submatrix in 
terms of the constants a(e). For instance. 



\Kei,K,,z\ = He*J - aie*J] HHe) - «(e;)][a(e) - aietj] 



eGZ 



H [a{e')-a{e)] (106) 

e,e'eZ,a(e)<a(e') 
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where we have assumed without loss of generality that the rows of f^z are ordered according 
to a. Expanding the determinants in (|102l) as such gives 



\KeZ^,el^,z\ l%,/2,z| l^e;,,/i,z| \Kel^j2,z\ (107) 

= [a{e*J - a{e*J][a{f,) - a{j\)][a{h) - a{e*J][a{h) - a{e*J] 

■ U^cyie) - a(e;)]2[a(e) - a(e;)]2[a(e) - a(A)]2[a(e) - aih)]' 
eez 

n He')-a{e)]\ (108) 

e,e'GZ,o{e)<a(e') 

Recall /i G H(t>i), /2 G H(t'2). Since we chose a such that the S sets are in opposite order to 
the edges e*, we have 

[a{e*J - a(e;)][«(/2) - < 0. (109) 

Moreover, since all the S sets have larger a values than the edges e*, 

a{h) - a{e*J > 0, (110) 
aih) - a{e*J > 0. (Ill) 

Hence, there is exactly one negative term in dlOSI) , from which we may conclude (I102I) . 
D. Proof of Lemma |5] 

The random vector W is distributed according to the type of the message vector as it is 
produced as the source. We formally introduce the random vector W representing the message 
as it is transformed in the network. As in our examples, this vector is distributed according to the 
joint type of the sequences as they appear in the network, after being corrupted by the adversary. 
For each edge e, we define Xg and X^. similarly as random variables jointly distributed with W 
and W respectively with distributions given by the expected and corrupted joint types. 

For every pair of nodes (i, j), we need to prove both of the following: 

If i is the traitor, and j E L, i cannot corrupt values in Kox^i^yW. (112) 
If j is the traitor, and i E L, j cannot corrupt values in Kox^i^yW. (113) 

In fact, each of these implies the other, so it will be enough to prove just one. Suppose (II 121) 
holds. Therefore, if the distribution observed by the destination of Kfj^^i j-^W does not match 
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that of KD^^i jjW, then at least one of i,j will not be in L. If they both were in L, it would 
have had to be possible for node i to be the traitor, make it appear as if node j were the traitor, 
but also corrupt part of Kj:,j_^i jyW . By (II 121) . this is impossible. Hence, if j is the traitor and 
i E then the distribution of the i^D±{j,i}^D rnust remain uncorrupted. This vector includes 
K£,±jW , a vector that can certainly not be corrupted by node j. Since xdink{K£,^j) > M — 2, 
and there are only M — 2 degrees of freedom, the only choice node j has to ensure that the 
distribution of -ft'z)±{i,j}W^ matches p is to leave this entire vector uncorrupted. That is, (|113l) 
holds. 

Fix a pair We proceed to prove either (|1 12|) or (II 131) . Doing so will require placing 

constraints on the actions of the traitor imposed by comparisons that occur inside the network, 
then applying one of the corollaries of Theorem |3] in Sec. IVIIII Let K±_i be a basis for the space 
orthogonal to Ki. If node i is the traitor, we have that K±_iW ~ K±^iW . Moreover, since j E 
-^DXjW) ~ K£)j_jW. These two constraints are analogous to (157]) and (l56l) respectively, where 
the symbols on the output of node i are analogous to Xi,X2. The subspace of Kd orthogonal 
to both Ki and Kj corresponds to Z in the example. We now seek pairwise constraints of the 
form (|58l) - (|60l) from successful comparisons to apply Theorem [3l 

Being able to apply Theorem [3] requires that K£)j_j has rank M — 2 for all j. Ensuring this 
has to do with the choices for the coefficients 7i,i,7j,2 used in (|86l) . A rank deficiency in KD±j 
is a singular event, so it is not hard to see that random choices for the 7 will cause this to occur 
with small probability. Therefore such 7 exist. 

We now discuss how pairwise constraints on the output symbols of i or j are found. Consider 
the following cases and subcases: 

• i,jE Wi U W2: Suppose node i is the traitor. Let ei, 62 be the output edges of node i. For 
each / = 1,2, we look for constraints on Xg, by following the p = p{ei) path until one of 
the following occurs: 

- We reach an edge on the p = p{ei) path carrying a symbol influenced by node 
j: This can only occur immediately after a branch node k with input edges /i,/2 
where p(/i) = p{ei), p(/2) < p{fi), and Xj^ is influenced by node j. At node k, a 
comparison occurs between Xf^, which is influenced by node i but not j, and Xf^. If 
the comparison succeeds, then this places a constraint on the distribution of {Xf^.Xf^). 
If the comparison fails, the forwarding pattern changes such that the p = p{ei) path 
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becomes a non-destination path; i.e. the value placed on ei does not affect any variables 
available at the destination. Hence, the subspace available at the destination that is 
corruptible by node i is of dimension at most one. 

- We reach node j itself: In this situation, we make use of the fact that we only need to 
prove that node i cannot corrupt values available at the destination that cannot also be 
influenced by node j. Consider whether the p — p{ei) path, between i and j, contains 
a branch node k with input edges /i, /2 such that = p{ei) and p(/2) > If 
there is no such node, then X^.^ cannot influence any symbols seen by the destination 
that are not also being influenced by j. That is, is in span(A'j_^/) fl Kj^d), so we 
do not have anything to prove. If there is such a branch node k, then the output edge 
e of k with p{e) = p(/2) contains a symbol influenced by i and not j. We may now 
follow the p — p{e) path from here to find a constraint on Xg,. If a comparison fails 
further along causing the forwarding pattern to change such that the p — p{e) path 
does not reach the destination, then the potential influence of on a symbol seen by 
the destination not influenced by node j is removed, so again we do not have anything 
to prove. 

- The p = p{ei) path leaves the network without either of the above occurring: Immedi- 
ately before leaving the network, the symbol will be compared with a non-destination 
symbol. This comparison must succeed, because j cannot influence the non-destination 
symbol. This gives a constraint Xei • 

We may classify the fates of the two symbols out of i as discussed above as follows: 

1) Either the forwarding pattern changes such that the symbol does not reach the desti- 
nation, or the symbol is in span{Ki^D n Kj^o), and so we do not need to prove that 
it cannot be corrupted. Either way, we may ignore this symbol. 

2) The symbol leaves the network, immediately after a successfully comparison with a 
non-destination symbol. 

3) The symbol is successfully compared with a symbol influenced by node j. In particular, 
this symbol from node j has a strictly smaller p value than p{ei). 

We divide the situation based on which of the above cases occur for Z = 1, 2 as follows: 

- Case 1 occurs for both 1 — 1,2: We have nothing to prove. 
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- Case 1 occurs for (without loss of generality) 1 = 1: Either case 2 or 3 gives a successful 
comparison involving a symbol influenced by Xg, • Applying Corollary \T\ allows us to 
conclude that Xg- cannot be corrupted. 

- Case 2 occurs for both I = 1, 2: If the two paths reach different non-destination symbols, 
then we may apply Lemma |4] to conclude that node i cannot corrupt either nor X^,^. 
Suppose, on the other hand, that each path reaches the same non-destination path, in 
particular the one associated with 2-to-l node v. Since 0(ei) ^ (p{e2), assume without 
loss of generality that 0(ei) ^ v. We may follow the path starting from ei through r(t>) 
to find an additional constraint, after which we may apply Corollary [21 AH symbols 
on this path are influenced by Xei- This path eventually crosses the non-destination 
path associated with v. If the symbol compared against the non-destination symbol at 
this point is not influenced by j, then the comparison succeeds, giving an additional 
constraint. Otherwise, there are two possibilities: 

* The path through V{y) reaches j: There must be a branch node on the path to V{y) 
before reaching j such that the path from ei has the smaller p value. If there were 
not, then case 1 would have occurred. Consider the most recent such branch node k 
in r(f ) before reaching j. Let /i, /2 be the input edges to k, where /i is on the path 
from ei. We know p(/i) < p(/2)- The comparison at k must succeed. Moreover, 
this successful comparison comprises a substantial constraint, because the only way 
the destination can decode Xf^ is through symbols influenced by node j. 

* The path through T{v) does not reach j: Let k be the first common node on the 
paths from i and j through r(t>). Let /i,/2 be the input edges of k, where /i is 
on the path from i and /2 is on the path from j. If the comparison at k succeeds, 
this provides a constraint. If it fails, then the forwarding pattern changes such that 
the p = p{fi) path becomes a non-destination path. Since we are not in case 1, 
p(ei) 7^ p(/i), but a symbol influenced by Xg^ is compared against a symbol on the 
p = p{fi) path at a branch node in T{v). This comparison must succeed, providing 
an additional constraint. 

- Case 3 occurs for (without loss of generality) I = 1, and either case 2 or 3 occurs 
for I = 2: We now suppose instead that node j is the traitor. That is, we will prove 
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(II 131) instead of (II 121) . Recall that a successful comparison occurs at a branch node 
k with input edges /i, /2 where is influenced by Xg^, X/j is influenced by node 
j, and p(/2) < p(/i)- Let e']^,e2 be the output edges of node j, and suppose that 
p{e[) = p(/2); i.e. the symbol Xj^ is influenced by X^'^. The success of the comparison 
gives a constraint on Xe[ - Since p(/2) < p(/i), we may continue to follow the p = p{f2) 
path from node k, and it continues to be not influenced by node i. As above, we 
may find an additional constraint on Xg'^ by following this p path until reaching a 
non-destination symbol or reaching another significant branch node. Furthermore, we 
may find a constraint on X^'^ in ^ similar fashion. This gives three constraints on 
Xe{ 5 Xe'^ , enough to apply Corollary [2l and conclude that node j cannot corrupt its 
output symbols. 

. i G W3 U ^2,1 \ Xin(L'), j e Wi U W2: Assume node i is the traitor. If i e V2,i with 
single output edge e such that -ipie) = 1, then node i controls no symbols received at the 
destination and we have nothing to prove. Otherwise, it controls just one symbol received 
at the destination, so any single constraint on node i is enough. Let e' be the output symbol 
of i with = 0. Since we assume i ^ J^i^^D), the p = p(e') path is guaranteed to cross 
a non-destination path after node i. As above, follow the p = p(e') path until reaching 
a branch node k at which the symbol is combined with one influenced by node j. If the 
comparison at node k succeeds, it gives a constraint on Xg'- If the comparison fails, then the 
forwarding pattern will change such that the p = p(e') path will fail to reach the destination, 
so we're done. 

• i E Wi U W2, j G 7^in{D): Assume node i is the traitor. By construction, since one output 
edge of j goes directly into the destination, the other must be on a non-destination path. 
Hence, j only controls one symbol at the destination, so we again need to place only one 
constraint on node i. Let e G £out(0 ^^^^ that 0(e) 7^ 0(e') for all e' G £out(j)- This 
is always possible, since the two output edges of i have different (p values, and since one 
output edge of j goes directly to the destination, only one of the output edges of j has a 
value. Let v = 0(e). Follow the path from e through A(v) until reaching the non-destination 
symbol at node k with input edges /i, /2. Assume X/^ is influenced by Xg and Xj^ is a 
non-destination symbol. The comparison between these two symbols must succeed, because 



53 



node j cannot influence either Xf-^ or Xf.,. This places the necessary constraint on Xg. 
• W3 U V2,i- Nodes i,j each control at most one symbol available at the destination, 

so either one, in order to make it appear as if the other could be the traitor, cannot corrupt 
anything. 

E. Proof of Theorem |2] when the Cut-set Bound is M — 3 

We now briefly sketch the proof of Theorem [2] for the case that the cut-set bound is M — 3. 
The proof is far less complicated than the above proof for the M — 2 case, but it makes use 
of many of the same ingredients. First note that the set of 2-to-2 nodes i that cannot reach any 
2-to-l nodes must form a path. We next perform a similar edge labeling as above, defining (p 
and 'tp as in (l80l)-(l8TI). Properties (A) and (B) must still hold, except that edges may have null 
labels, and property (C) is replaced by 

C For every 2-to-2 node that can reach at least one 2-to-l node, at least one of its output 
edges must have a non-null label. 
Internal nodes operate in the same way based on the edge labels as above, where symbols are 
always forwarded along edges with null labels. The decoding process is the same. Proving an 
analogous version of Lemma [5] requires only finding a single constraint on one of i or j. This 
is always possible since one is guaranteed to have a label on an output edge, unless they are 
both in the single path with no reachable 2-to-l nodes, in which case they influence the same 
symbol reaching the destination. 

Interestingly, this proof does not make use of the planarity of the graph. We may therefore 
conclude that for networks satisfying properties (2) and (3) in the statement of Theorem |2l the 
cut-set bound is always achievable if the cut-set is strictly less than M — 2. 

X. Looseness of the Cut-set Bound 

So far, the only available upper bound on achievable rates has been the cut-set bound. We 
have conjectured that for planar graphs this bound is tight, but that still leaves open the question 
of whether there is a tighter upper bound for non-planar graphs. It was conjectured in fTOl that 
there is such a tighter bound, and here we prove this conjecture to be true. We do this in two 
parts. First, consider the problem that the traitor nodes in a Byzantine attack are constrained 
to be only from a certain subset of nodes. That is, a special subset of nodes are designated as 
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potential traitors, and the code must guard against adversarial control of any z of those nodes. 
We refer to this as the limited-node problem. Certainly the limited-node problem subsumes 
the all-node problem, since we may simply take the set of potential traitors to be all nodes. 
Furthermore, it subsumes the unequal-edges problem studied in IfTOl , because given an instance 
of the unequal-edge problem, an equivalent all-node problem can be constructed as follows: 
create a new network with every edge replaced by a pair of edges of equal capacity with a node 
between them. Then limit the traitors to be only these interior nodes. 

We will show in Section IX-AI that the all-node problem actually subsumes the limited-node 
problem, and therefore also the unequal-edge problem. Then in Section IX-BI we give an example 
of a limited-node network for which there is an active upper bound on capacity other than the 
cut-set. This proves that, even for the all-node problem, the cut-set bound is not tight in general. 
Transforming the example in Section IX-B I into an unequal-edge problem is not hard; this therefore 
confirms the conjecture in ifTOl . 

A. Equivalence of Limited-Node and All-Node 

Let {V, E) be a network under a limited-node Byzantine attack, where there may be at most 
z traitors constrained to be in f/ C V , and let C be its capacity. We construct a sequence of 
all-node problems, such that finding the capacity of these problems is enough to find that of the 
original limited-node problem. Let (y^^^\ E'^^''^) be a network as follows. First make M copies 
of {y,E). That is, for each i e V, put z^^^ . . . into V^'^'^\ and for each edge e E, 
put into E^^^\ Then, for each i G U, merge . . . , i^^'^'^ into a single 

node i*, transferring all edges that were previously connected to any of . . . to i*. Let 
(jiM) j]^g all-node capacity of {V^^^\ E^^'^^) with z traitors. This construction is illustrated in 
Fig. [I2l where we show a limited-node network {V, E) and the all-node network {V^^'^\ E^^^^) 
with M = 3. For large M, the all-node problem will be such that for any i ^ U, the adversary 
has no reason to control one of the respective nodes because it commands such a small fraction 
of the information flow through the network. That is, we may assume that the traitors will only 
ever be nodes in U. This is stated explicitly in the following theorem. 

Theorem 4: For any M, C*-^^^ is related to C by 

]_(j{M) < ^ < \ ^{M)_ 

M - - M -2z 
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Moreover, 



C= lim ^C^^'^^ (115) 



and if C^^^ can be computed to arbitrary precision for any M in finite time, then so can C . 

Proof: We first show that ^gC^*^) < C. Take any code on (^(a^), E^*^)) achieving rate R 
when any z nodes may be traitors. We use this to construct a code on iy.E), achieving rate 
RjM when any z nodes in U may be traitors. We do this by first increasing the block-length 
by a factor of M, but maintaining the same number of messages, thereby reducing the achieved 
rate by a factor of M. Now, since each edge in iy, E) corresponds to M edges in {y'^^^\ E^^^^), 
we may place every value transmitted on an edge in the (y^^'^\E^^'^^) code to be transmitted 
on the equivalent edge in the {V, E) code. That is, all functions executed by . . . are 
now executed by i. The original code could certainly handle any z traitor nodes in U. Hence 
the new code can handle any z nodes in U, since the actions performed by these nodes have not 
changed from (^(a^), ^(a^)) to {V,E). Therefore, the new code on {V,E) achieving rate R/M 
for the limited-node problem. 

Now we show that C < jg^C**^^^^- Take any code on {V, E) achieving rate R. We will 
construct a code on (V(^'^\ E^^'^^) achieving rate (M — 2z)R. This direction is slightly more 
difficult because the new code needs to handle a greater variety of traitors. The code on 
(y^^'^\ is composed of an outer code and M copies of the (V, E) code running in parallel. 

The outer code is a {M,M — 2z) MDS code with coded output values Wi, . . . ,wm- These 
values form the messages for the inner codes. Since we use an MDS code, if wi, . . . ,wm are 
reconstructed at the destination such that no more than z are corrupted, the errors can be entirely 
corrected. The jth copy of the (V, E) code is performed by i* for i E U, and by i^^^ for i ^ U. 
That is, nodes in U are each involved in all M copies of the code, while nodes not in U are 
involved in only one. Because the (V, E) code is assumed to defeat any attack on only nodes 
in U, if for some j, no nodes i^^^ fori^U are traitors, then the message wj will be recovered 
correctly at the destination. Therefore, one of the wj could be corrupted only if i^^^ is a traitor 
for some i ^ U. Since there are at most z traitors, at most of the wi, . . . ,wm will be corrupted, 
so the outer code corrects the errors. 

From (II 141) . (II 151) is immediate. We can easily identify M large enough to compute C to any 
desired precision. ■ 
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Fig. 12. A network with capacity strictly less than the cut-set bound. The limited-node network is shown on the left, and the 
equivalent all-node problem with 3 copies is shown on the right. 

The significance of Theorem |4] is that if we could calculate the capacity of any all-node 
problem, we could use (|1 14|) to calculate the capacity of any limited-node problem. Furthermore, 
it is easy to see that for large M the cut-set bound of E^'^^^) is simply M times the cut-set 

bound of (V, E). Hence a limited-node example with capacity less than the cut-set bound — such 
as the one in Section IX-Bj — leads directly to an all-node example with capacity less than the 
cut-set bound. 

B. Example with Capacity Less than Cut-Set 

Consider the network shown in Figure [l2l There is at most one traitor, but it may only be 
one of nodes 1-4. The cut-set bound is easily seen to be 2, but in fact the capacity is no more 
than 1.5. 

Suppose we are given a code achieving rate R. We show that R < 1.5. For i = 1,2, 3, 4, let 
Xi be the random variable representing the value on the output edge of node i. Let Y be the 
value on edge (9, D) and let Z be the value on (10, D). Let p be the honest distribution on these 
variables, and define the following alternative distributions: 

qs = pixiX2X4)p{x3)p{y\xiX2X3)p{z\x3X4), (116) 

54 = p{xiX2X3)p{x4)p{y\xiX2X3)p{z\x3X4). (1 17) 

We may write 

R<Ig,{XiX2X4;YZ) (118) 
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because, if node 3 is the traitor, it may generate a completely independent version of X3 and 
send it along edge (37), resulting in the distribution ^3. In that case, assuming the destination 
can decode properly, information about the message must get through from the honest edges at 
the start of the network, Xi, X2, X^, to what is received at the destination, Y,Z. From (II 181) . 
we may write 

R < Ig,iXiX2X^; Z) + /,3(XiX2X4; Y\Z) (119) 
< I,,{Xi- Z) + /(X1X2; ZIX4) + 1 (120) 
= /,3(X4;Z) + l (121) 

where in (11201) we have used that the capacity of (9, D) is 1, and in (|12H) that X1X2 — X4 — Z 
is a Markov chain according to gs. Using a similar argument in which node 4 is the traitor and 
it acts in a way to produce 54, we may write 

i?</,,(X3;Z) + l. (122) 

Note that 

g3(x3X4z) = qi{x^Xiz). (123) 

In particular, the mutual informations in (I121|) and (11221) can both be written with respect to the 
same distribution. Therefore, 

2i? < /,3(X4; Z) + J,3(X3; Z) + 2 (124) 

= /,3(X3X4; Z) + /,3(X3; X4) - 1,3 (X3; X^\Z) + 2 (125) 

<I,,{X^X^-Z) + 2 (126) 

< 3 (127) 

where (11261) follows from the positivity of conditional mutual information and that X3,X4 are 
independent according to ^3, and (11271) follows because the capacity of (10, D) is 1. Therefore, 
R < 1.5. 

Observe that all inequalities used in this upper bound were so-called Shannon-type inequalities. 
For the non-Byzantine problem, there is a straightforward procedure to write down all the 
Shannon-type inequalities relevant to a particular network coding problem, which in principle 
can be used to find an upper bound. This upper bound is more general than any cut-set upper 
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bound, and in some multi-source problems it has been shown to be tighter than any cut-set bound. 
This example illustrates that a similar phenomenon occurs in the Byzantine problem even for a 
single source and single destination. As the Byzantine problem seems to have much in common 
with the multi-source non-Byzantine problem, it would be worthwhile to formulate the tightest 
possible upper bound using only Shaimon-type inequalities. However, it is yet unclear what the 
"complete" list of Shannon type inequalities would be for the Byzantine problem. This example 
certainly demonstrates one method of finding them, but whether there are fundamentally different 
methods to find inequalities that could still be called Shannon-type, or even how to compile all 
inequalities using this method, is unclear. Moreover, it has been shown in the non-Byzantine 
problem that there can be active non-Shannon-type inequalities. It is therefore conceivable that 
non-Shannon-type inequalities could be active even for a single source under Byzantine attack. 

XI. Conclusion 

The main contribution of this paper has been to introduce the theory of Polytope Codes. As far 
as we know, they are the best known coding strategy to defeat generalized Byzantine attacks on 
network coding. However, it remains difficult to calculate the best possible rate they can achieve 
for a given network. We have proved that they achieve the cut-set bound, and hence the capacity, 
for a class of planar graphs, and we conjecture that this holds for all planar graphs. One would 
obviously hope to find the capacity of all networks, including non-planar ones. We have shown 
that achieving the cut-set bound is not always possible, meaning there remains significant work 
to do on upper bounds as well as achievable schemes. Whether Polytope Codes can achieve 
capacity on all networks remains an important open question. 

Appendix A 
Tighter Cut- set Upper bound 

Theorem 5: Consider a cut A C V with S E A and D ^ A. Let Ea be the set of edges 
that cross the cut. For two not necessarily disjoint sets of possible traitors Ti, T2, let Ei and E2 
be the subset of edges in Ea that originate at nodes in Ti and T2 respectively. Let E be the 

set of edges in Ei fl E2 in addition to all edges e G Ei U E2 for which there is no path that 
flows through e followed by any edge in Ea\Ei\E2. The following upper bound holds on the 
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capacity of the network: 

C< ^ Ce. (128) 

e&EA\E 

Proof: Suppose ([U) were not true for some A, Ti, and T2. Then there would exist a code 
achieving a rate R such that 

/?> 5^ C (129) 

e&EA\E 

We will consider two possibilities, one when Ti are the traitors and they alter the values on 
El n E, and one when T2 are the traitors and they alter the values on £'2 H -E. We will show that 
by (11291 ). it is possible for the traitors to act in such a way that even though the messages at the 
source are different, all values sent across the cut are the same; therefore the destination will 
not be able to distinguish all messages. Note that traitors in Ti or T2 will only corrupt values 
on edges in E; that is, those edges controlled by either set of traitors, or those that could not 
influence Ea \ Ei \ E2. 

Fix a value z representing one possible set of values that may be placed on the edges Eir]E2. 
By definition, no edges in E\ (Ei fl E2) are upstream of edges in Ea \ E. Since the traitors act 
honestly on all edges not in E, given z, the values on Ea \E are a function of the message, so 
by (11291) . there exist two messages Wa and Wb that cannot be distinguished just from Ea \ E. 
Call y the set of values on these edges under Wa or Wb. 

Choose a coding order on the edges in E\ (Ei fl E2) written as 

{h,l2,...,lK) (130) 

where K = \E \ (Ei fl -£^2)!, such that if there is a path through li followed by Ij, then i < j. 
Observe that E \ {Ei fl E2) can be divided into E \ E2 and E \ Ei, and therefore the order 
in (|130l) must alternate between edges in the two sets. Maintaining the order in (|130l) . we may 
group the edges by the two sets, rewriting (11301) as 

(l[i,Vi,l[2,V2,...,lX^,,VxO (131) 

where Ui C E\E2 and Vj C E\E2, and K' is the number of times the edges in (|130l) alternate 
between the two sets. Note that Ui or V^/ may be empty. 

We now construct the manner in which the two possible sets of traitors, Ti or T2, may cause 
Wa and Wb to become indistinguishable. Suppose Wa is the message, Ti are the traitors, they 
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place z on El n E2, but behave honestly on all other edges. We denote the values on all edges 
crossing the cut as 

{z,y,u^^\v^^\u?,vi'\...,u^i],v^i}) (132) 

where z represents the values on Ei fl E2, y the values on E^ \ E, and uf''' and v^^^ are the 
values placed on Uj and Vj respectively. Note that only the Ui values are directly adjustable by 
the traitors, but they may affect elements later in the sequence. 

Alternatively, if Wa is the message, T2 are the traitors, and they place z on EinE2, but behave 
honestly elsewhere, the values across the cut are denoted 

/ (2) (2) (2) (2) (2)n /ioon 

[z,y,u\',v\',u\\v\',..., vy). (133) 

Here, only the Vi values may be changed directly by the traitors. 

In the two scenarios, the traitors may alter their output values so that (11321) and (11331) are 
transformed to become identical. This can be done as follows. In (11321) . the traitors may replace 
u^i^ with uf\ Downstream edges are either controlled by honest nodes, or they are controlled 
by traitors that continue, for now, to behave honestly. Hence, this change may affect the later 
edges in the sequence, but they do so in a way determined only by the code. This results in a 
set of values denoted by 

/ (2) (3) (3) (3) (3) (3)x r-\'2A\ 

{z,y,u\',vl \u\\v\ uy,,vy,). (134) 
In (I133|) . the traitors may now replace vf^ with v^i \ resulting in 

{z,y,u^\vf\u^\v^\...,v^^]). (135) 

We may now return to (|134l) and replace Wg'^'' with \ further changing downstream values. 
Continuing this process will cause the two sequences to become identical, thereby making Wa 
and Wb indistinguishable at the destination. ■ 

Appendix B 

Proof of Bound on Linear Capacity for the Cockroach Network 

We show that no linear code for the Cockroach Network, shown in Figure [H can achieve a 
rate higher than 4/3. Fix any linear code. For any link (z, j), let Xj j be the value placed on this 
link. For every node i, let Xj be the set of messages on all links out of node i, and Yi be the 
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set of messages on all links into node i. Let Gxi-^Vj be the linear transformation from Xj to Yj, 
assuming all nodes behave honestly. Observe that 

Xi^Yo'^i (136) 

i 

where represents the difference between what a traitor places on its outgoing links and what 
it would have placed on those links if it were honest. Only one node is a traitor, so at most 
one of the Cj is nonzero. Note also that the output values of the source Xs is a function of the 
message w. We claim that for any achievable rate R, 



R<1 

n 



rank(Gxs^yD) - maxrank(Gx.x,->yB> 

hi 



(137) 



where n is the block length used by this code. To show this, first note that for any pair of nodes 
i,j there exist K, Hi, H2 such that 

Gxs^Yo = K + Gxi^YoHi + Gxj^YoH2 (138) 

and where 

rank(i^) = rank(Gxs^y^) - rank(Gx,x,^yo)- (139) 

That is, the first term on the right hand side of (11381) represents the part of the transformation 
from Xs to Yd that cannot be influenced by Xi or Xj. Consider the case that rank(i^') < R. 
Then there must be two messages Wi,W2 such that KXs{wi) = KXs{w2). If the message is 
wi, node i may be the traitor and set 

e, = Hi{Xs{w2)-Xs{wi)). (140) 
Alternatively, if the message is W2, node j may be the traitor and set 

ej=H2{Xs{wi)-Xs{w2)). (141) 
In either case, the value received at the destination is 



Yn = KXs{wi) + Gx^^YoHiXs{w2) 



+ Gx,^YnH2Xsiwi). 



Therefore, these two cases are indistinguishable to the destination, so it must make an error for 
at least one of them. This proves (|137l) . 
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Now we return to the specific case of tlie Cockroacli Network. Observe tliat tlie X4 is a 
linear combination of Xi 4 and X2 4. Let ki be the number of dimensions of X4 that depend 
only on Xi 4 and are independent of X2,4. Let k2 be the number of dimensions of X4 that 
depend only on X2 4, and let be the number of dimensions that depend on both Xi 4 and 
X2,4. Certainly ki + k2 + k^ < n. Similarly, let /i, I2, 13 be the number of dimensions of X5 that 
depend only on X2,5, that depend only on X3 5, and that depend on both respectively. Finally, 
let mi and m2 be the number of dimensions of Xi d and X3 £) respectively. 

We may write the following: 

rank(G'xs^y4) - rank(G'x2,x3^y4) <mi + fci, 

rank(Gxs^r4) - ra.nk{GxuX3^Yi) <k3 + h, 

rank(Gxs^y4) - rank(Gxi,X2^y4) < ^3 + "^2- 

Therefore, using (|137l) . any achievable rate R is bounded by 

R < -mm{mi + ki,k3 + hjs + 1712} (142) 
n 

subject to 

ki + k2 + k3< n, (143) 
h + k + h< n, (144) 
mi < n, (145) 
m2 < n. (146) 
It is not hard to show that this implies R < 4/3. 
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